fix: redact sensitive pipeline headers#826
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Extends the workflow engine’s recursive step-output redaction to cover sensitive HTTP header fields (e.g., Authorization, Cookie/Set-Cookie, and hyphenated API key headers) and adds tests to ensure debug logs redact these values while preserving raw pipeline results for response handling.
Changes:
- Expanded
SensitiveFieldPatternsto includeauthorization,cookie, andapi-keyfor better header redaction coverage. - Added module-level test coverage for nested sensitive header keys while ensuring non-sensitive headers remain visible.
- Added engine-level test coverage ensuring DEBUG result logs redact sensitive header values while
PipelineResultHolderretains raw (unredacted) results.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| module/step_output_redactor.go | Adds additional sensitive key patterns to ensure common HTTP auth/session headers and hyphenated API key headers are redacted. |
| module/step_output_redactor_test.go | Adds coverage for nested headers maps to verify sensitive header keys redact and benign keys (e.g., Content-Type) remain intact. |
| engine_test.go | Adds an integration test proving engine DEBUG logs redact sensitive result headers while preserving raw results in the context holder. |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #825.
Verification