chore: Experiment with masking

.github/workflows/tests.yml

@@ -36,54 +36,73 @@ jobs:
           go-version-file: ./go.mod
           cache: false
 
-      - name: Install dependencies
-        run: make dev-setup
+      - name: GH Actions env
+        run: echo "$GITHUB_ACTIONS"
 
-      - name: Create and populate .snowflake/config file
-        id: create_config
-        run: mkdir -p $HOME/.snowflake && echo "${{ secrets.SNOWFLAKE_CONFIG_FILE }}" > $HOME/.snowflake/config
+      - name: Experiment with case
+        run: echo "::add-mask::cAsE dOeS nOt MaTtEr"
 
-      - name: Create and populate .snowflake/config_v097_compatible file
-        id: create_config_v097_compatible
-        run: mkdir -p $HOME/.snowflake && echo "${{ secrets.SNOWFLAKE_CONFIG_FILE_V097_COMPATIBLE }}" > $HOME/.snowflake/config_v097_compatible
+      - name: Echo different case
+        run: |
+          echo "cAsE dOeS nOt MaTtEr"
+          echo "CASE DOES NOT MATTER"
+          echo "case does not matter"
 
-      - run: make test
-        if: ${{ !cancelled() && steps.create_config.conclusion == 'success' }}
+      - name: Experiment single line env
+        run: echo "::add-mask::$TEST_SF_TF_ONE_LINER"
         env:
-          SNOWFLAKE_BUSINESS_CRITICAL_ACCOUNT: ${{ secrets.SNOWFLAKE_BUSINESS_CRITICAL_ACCOUNT }}
-          TEST_SF_TF_AWS_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_BUCKET_URL }}
-          TEST_SF_TF_AWS_EXTERNAL_KEY_ID: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_KEY_ID }}
-          TEST_SF_TF_AWS_EXTERNAL_ROLE_ARN: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_ROLE_ARN }}
-          TEST_SF_TF_AWS_EXTERNAL_SECRET_KEY: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_SECRET_KEY }}
-          TEST_SF_TF_AZURE_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_BUCKET_URL }}
-          TEST_SF_TF_AZURE_EXTERNAL_SAS_TOKEN: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_SAS_TOKEN }}
-          TEST_SF_TF_AZURE_EXTERNAL_TENANT_ID: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_TENANT_ID }}
-          TEST_SF_TF_GCS_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_GCS_EXTERNAL_BUCKET_URL }}
-
-      - name: Setup Terraform
-        if: ${{ !cancelled() && steps.create_config.conclusion == 'success' }}
-        uses: hashicorp/setup-terraform@v3
-        id: setup_terraform
-        with:
-          terraform_version: 1.7.4
-          terraform_wrapper: false
+          TEST_SF_TF_ONE_LINER: ${{ secrets.TEST_SF_TF_ONE_LINER }}
 
-      - run: make test-acceptance
-        if: ${{ !cancelled() && steps.setup_terraform.conclusion == 'success' }}
+      - name: Experiment multiple lines env
+        run: echo "::add-mask::$TEST_SF_TF_MULTI_LINER"
         env:
-          SNOWFLAKE_BUSINESS_CRITICAL_ACCOUNT: ${{ secrets.SNOWFLAKE_BUSINESS_CRITICAL_ACCOUNT }}
-          TEST_SF_TF_AWS_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_BUCKET_URL }}
-          TEST_SF_TF_AWS_EXTERNAL_KEY_ID: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_KEY_ID }}
-          TEST_SF_TF_AWS_EXTERNAL_ROLE_ARN: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_ROLE_ARN }}
-          TEST_SF_TF_AWS_EXTERNAL_SECRET_KEY: ${{ secrets.TEST_SF_TF_AWS_EXTERNAL_SECRET_KEY }}
-          TEST_SF_TF_AZURE_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_BUCKET_URL }}
-          TEST_SF_TF_AZURE_EXTERNAL_SAS_TOKEN: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_SAS_TOKEN }}
-          TEST_SF_TF_AZURE_EXTERNAL_TENANT_ID: ${{ secrets.TEST_SF_TF_AZURE_EXTERNAL_TENANT_ID }}
-          TEST_SF_TF_GCS_EXTERNAL_BUCKET_URL: ${{ secrets.TEST_SF_TF_GCS_EXTERNAL_BUCKET_URL }}
-
-      - name: sweepers cleanup
-        if: ${{ always() }}
-        run: echo y | make sweep
+          TEST_SF_TF_MULTI_LINER: ${{ secrets.TEST_SF_TF_MULTI_LINER }}
+
+      - name: Experiment all lines from env
+        run: |
+          while IFS= read -r line || [[ -n $line ]]; do
+            echo "masking $line"
+            echo "::add-mask::$line"
+          done < <(printf '%s' "$TEST_SF_TF_ALL_LINES")
+        env:
+          TEST_SF_TF_ALL_LINES: ${{ secrets.TEST_SF_TF_ALL_LINES }}
+
+      - name: Echo single line env content
+        run: |
+          echo "very secret info"
+          echo "$TEST_SF_TF_ONE_LINER"
+        env:
+          TEST_SF_TF_ONE_LINER: ${{ secrets.TEST_SF_TF_ONE_LINER }}
+
+      - name: Echo multiple lines env content
+        run: |
+          echo "masking does not\nwork this way.\n!@#$%^&*()_+=-1234567890"
+          echo "$TEST_SF_TF_MULTI_LINER"
+          echo "masking does not"
+        env:
+          TEST_SF_TF_MULTI_LINER: ${{ secrets.TEST_SF_TF_MULTI_LINER }}
+
+      - name: Echo different lines from all lines env
+        run: |
+          echo "different space-separated"
+          echo "really, really, really"
+          echo "secret infos"
+          echo "different space-separated really, really, really secret infos"
+          echo "really, really,"
+          echo "different"
+          echo "infos"
+          echo "$TEST_SF_TF_ALL_LINES"
+        env:
+          TEST_SF_TF_ALL_LINES: ${{ secrets.TEST_SF_TF_ALL_LINES }}
+
+      - name: Install dependencies
+        run: make dev-setup
+
+      - run: make test-experiment
+        env:
+          TEST_SF_TF_ONE_LINER: ${{ secrets.TEST_SF_TF_ONE_LINER }}
+          TEST_SF_TF_MULTI_LINER: ${{ secrets.TEST_SF_TF_MULTI_LINER }}
+          TEST_SF_TF_ALL_LINES: ${{ secrets.TEST_SF_TF_ALL_LINES }}
 
       - name: find comment
         if: ${{ always() }}

Makefile

@@ -61,6 +61,9 @@ sweep: ## destroy the whole architecture; USE ONLY FOR DEVELOPMENT ACCOUNTS
 			else echo "Aborting..."; \
 		fi;
 
+test-experiment: ## run experiment
+	go test ./pkg/experiments/... -v
+
 test: test-client ## run unit and integration tests
 	go test -v -cover -timeout=45m ./...
 

pkg/acceptance/testenvs/testing_environment_variables.go

@@ -36,6 +36,8 @@ const (
 	ConfigureClientOnce      env = "SF_TF_ACC_TEST_CONFIGURE_CLIENT_ONCE"
 	TestObjectsSuffix        env = "TEST_SF_TF_TEST_OBJECT_SUFFIX"
 	RequireTestObjectsSuffix env = "TEST_SF_TF_REQUIRE_TEST_OBJECT_SUFFIX"
+
+	GithubActions env = "GITHUB_ACTIONS"
 )
 
 func GetOrSkipTest(t *testing.T, envName Env) string {

pkg/experiments/experiment_test.go

@@ -0,0 +1,126 @@
+package experiments
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	"github.com/Snowflake-Labs/terraform-provider-snowflake/pkg/acceptance/testenvs"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions?tool=bash#masking-a-value-in-a-log
+// https://github.com/actions/runner/issues/161
+// https://dev.to/yuyatakeyama/mask-multiple-lines-text-in-github-actions-workflow-1a0
+// https://www.aaron-powell.com/posts/2022-07-14-working-with-add-mask-and-github-actions/
+// https://stackoverflow.com/a/73041579
+func Test_experiments(t *testing.T) {
+	ghActionsValue := testenvs.GetOrSkipTest(t, testenvs.GithubActions)
+
+	echoWithOutput := func(t *testing.T, content string) string {
+		t.Helper()
+		cmd := exec.Command("echo", content)
+		t.Log(cmd.String())
+		output, err := cmd.Output()
+		require.NoError(t, err)
+		return strings.TrimSpace(string(output))
+	}
+
+	maskOnCi := func(t *testing.T, line string) string {
+		t.Helper()
+		if ghActionsValue == "true" {
+			t.Logf("trying to mask using `%s`", line)
+			return echoWithOutput(t, line)
+		}
+		return ""
+	}
+
+	// This test show that programmatically we are not able to mask using the GH workflow command.
+	t.Run("dynamic masking", func(t *testing.T) {
+		value := "something to mask"
+
+		for idx, option := range []string{
+			`::add-mask::%s`,
+			`"::add-mask::%s"`,
+			`'::add-mask::%s'`,
+			`::add-mask::"%s"`,
+			`::add-mask::'%s'`,
+			`::add-mask:: %s`,
+			`::add-mask:: "%s"`,
+			`::add-mask:: '%s'`,
+			`"::add-mask:: %s"`,
+			`'::add-mask:: %s'`,
+		} {
+			output := maskOnCi(t, fmt.Sprintf(option, value))
+			assert.Contains(t, output, value)
+
+			t.Logf("option %d: %s", idx+1, value)
+		}
+	})
+
+	// This test assumes that TEST_SF_TF_ONE_LINER is set to `very secret info`
+	t.Run("masking from single line env", func(t *testing.T) {
+		testenvs.AssertEnvSet(t, "TEST_SF_TF_ONE_LINER")
+
+		value := os.Getenv("TEST_SF_TF_ONE_LINER")
+
+		t.Log(value)
+		t.Log("very secret info")
+		t.Log("secret info")
+
+		output := echoWithOutput(t, value)
+		assert.NotEqual(t, "***", output)
+		assert.Equal(t, value, output)
+
+		output = echoWithOutput(t, "very secret info")
+		assert.NotEqual(t, "***", output)
+		assert.Equal(t, "very secret info", output)
+
+		output = echoWithOutput(t, "secret info")
+		assert.Equal(t, "secret info", output)
+	})
+
+	// This test assumes that TEST_SF_TF_MULTI_LINER is set to:
+	//  masking does not
+	//  work this way.
+	//  !@#$%^&*()_+=-1234567890
+	t.Run("masking from multi line env", func(t *testing.T) {
+		testenvs.AssertEnvSet(t, "TEST_SF_TF_MULTI_LINER")
+
+		value := os.Getenv("TEST_SF_TF_MULTI_LINER")
+
+		t.Log(value)
+		t.Log("masking does not\nwork this way.\n!@#$%^&*()_+=-1234567890")
+		t.Log("masking does not work this way. !@#$%^&*()_+=-1234567890")
+		t.Log("masking does not")
+	})
+
+	// This test assumes that TEST_SF_TF_ALL_LINES is set to:
+	//  different space-separated
+	//  really, really, really
+	//  secret infos
+	t.Run("masking all lines from env", func(t *testing.T) {
+		testenvs.AssertEnvSet(t, "TEST_SF_TF_ALL_LINES")
+
+		value := os.Getenv("TEST_SF_TF_ALL_LINES")
+
+		t.Log(value)
+		t.Log("different space-separated really, really, really secret infos")
+		t.Log("different space-separatedreally, really, reallysecret infos")
+
+		output := echoWithOutput(t, value)
+		assert.NotEqual(t, "***\n***\n***\n***", output)
+		assert.Equal(t, value, output)
+
+		output = echoWithOutput(t, "different space-separated really, really, really secret infos")
+		assert.NotEqual(t, "*** *** *** ***", output)
+		assert.Equal(t, "different space-separated really, really, really secret infos", output)
+
+		output = echoWithOutput(t, "different space-separatedreally, really, reallysecret infos")
+		assert.NotEqual(t, "***", output)
+		assert.Equal(t, "different space-separatedreally, really, reallysecret infos", output)
+	})
+}