working secret option that hides default value from option usage message

CHANGELOG.md

@@ -6,6 +6,7 @@ and this project adheres to [Semantic
 Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## Unreleased
+- Added support for to designated PluginConfigOptions as Secret. If Secret, the default value for the argument will not be displayed in the usage message. This prevents sensitive values stored in envvars from leaking into the usage message.
 
 ## [0.7.0] - 2020-06-03
 

sensu/gohandler_test.go

@@ -36,6 +36,7 @@ var (
 		Path:      "path1",
 		Shorthand: "d",
 		Usage:     "First argument",
+		Secret:    true,
 	}
 
 	defaultOption2 = PluginConfigOption{

sensu/gomutator_test.go

@@ -33,6 +33,7 @@ var (
 		Path:      "path1",
 		Shorthand: "d",
 		Usage:     "First argument",
+		Secret:    true,
 	}
 
 	mutatorOption2 = PluginConfigOption{

sensu/goplugin.go

@@ -50,6 +50,9 @@ type PluginConfigOption struct {
 
 	// Usage adds help context to the command-line flag.
 	Usage string
+
+	// If secret option do not copy Argument value into Default
+	Secret bool
 }
 
 // PluginConfig defines the base plugin configuration.
@@ -193,6 +196,12 @@ func setupFlag(cmd *cobra.Command, opt *PluginConfigOption) error {
 	default:
 		return fmt.Errorf("invalid input type: %v", kind)
 	}
+	flag := cmd.Flags().Lookup(opt.Argument)
+	// Set empty DefValue string if option is a secret
+	// DefValue is only used for pflag usage message construction
+	if opt.Secret {
+		flag.DefValue = ""
+	}
 	return nil
 }