flecto 2.1.0 → 3.0.0

package/src/pr-comment.js

@@ -0,0 +1,480 @@
+import { readFileSync } from 'fs';
+import { isAbsolute, relative } from 'path';
+
+/**
+ * Hidden marker embedded in every rendered body. Flecto finds its own comment by
+ * searching for this string, so repeated runs update one sticky comment instead
+ * of appending a new one on every push.
+ */
+export const PR_COMMENT_MARKER = '<!-- flecto:pr-comment -->';
+
+const DEFAULT_API_URL = 'https://api.github.com';
+const DEFAULT_TIMEOUT_MS = 10_000;
+/** GitHub rejects comment bodies longer than 65536 characters. */
+const MAX_BODY_CHARS = 60_000;
+const MAX_INLINE_CHANGES = 10;
+const MAX_VALUE_CHARS = 120;
+const MAX_COMMENT_PAGES = 10;
+const COMMENTS_PER_PAGE = 100;
+const SEVERITY_ORDER = ['error', 'warn', 'info'];
+const SEVERITY_HEADINGS = { error: 'Errors', warn: 'Warnings', info: 'Notices' };
+const SEVERITY_NOUNS = { error: 'error', warn: 'warning', info: 'notice' };
+
+/**
+ * @typedef {{ file: string, envelope: import('./envelope.js').FlectoEnvelope, policies?: import('./policy.js').PolicyFinding[] }} CiResult
+ * @typedef {{ repo: string, prNumber: number, token: string, apiUrl: string }} PrCommentContext
+ */
+
+/**
+ * Render a value inside a markdown code span, widening the fence so embedded
+ * backticks cannot terminate it early.
+ * @param {string} text
+ * @returns {string}
+ */
+function inlineCode(text) {
+  const value = String(text);
+  const runs = value.match(/`+/g) ?? [];
+  const fence = '`'.repeat(Math.max(0, ...runs.map((run) => run.length)) + 1);
+  const pad = value.startsWith('`') || value.endsWith('`') ? ' ' : '';
+  return `${fence}${pad}${value}${pad}${fence}`;
+}
+
+/**
+ * Make a string safe for a markdown table cell: pipes end the cell (even inside
+ * a code span) and newlines end the row.
+ * @param {string} text
+ * @returns {string}
+ */
+function tableCell(text) {
+  return String(text).replaceAll(/\r?\n/gu, ' ').replaceAll('|', '\\|');
+}
+
+/**
+ * @param {string} text
+ * @param {number} max
+ * @returns {string}
+ */
+function truncate(text, max) {
+  return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+
+/**
+ * Format a change value for display, or return null when the side is absent.
+ * @param {unknown} value
+ * @returns {string | null}
+ */
+function formatValue(value) {
+  if (value === undefined) return null;
+  const json = JSON.stringify(value);
+  return truncate(json === undefined ? String(value) : json, MAX_VALUE_CHARS);
+}
+
+/**
+ * Show repository-relative paths where possible; absolute runner paths are
+ * noise in a PR comment.
+ * @param {string} file
+ * @param {string} [cwd]
+ * @returns {string}
+ */
+function displayPath(file, cwd) {
+  const value = String(file);
+  if (!cwd || !isAbsolute(value)) return value;
+  const rel = relative(cwd, value);
+  if (!rel || rel.startsWith('..') || isAbsolute(rel)) return value;
+  return rel.replaceAll('\\', '/');
+}
+
+/**
+ * @param {number} count
+ * @param {string} noun
+ * @returns {string}
+ */
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+
+/**
+ * @param {CiResult} result
+ * @returns {import('./differ.js').ChangeEvent[]}
+ */
+function changesOf(result) {
+  return result?.envelope?.changes ?? [];
+}
+
+/**
+ * @param {CiResult} result
+ * @returns {import('./policy.js').PolicyFinding[]}
+ */
+function findingsOf(result) {
+  return result?.policies ?? result?.envelope?.policies ?? [];
+}
+
+/**
+ * Render the markdown body of the sticky pull request comment.
+ *
+ * Pure: it reads nothing but its arguments, so the exact body posted to GitHub
+ * is the body printed to stdout.
+ * @param {CiResult[]} results
+ * @param {{ cwd?: string, failed?: boolean, marker?: string, maxInlineChanges?: number, maxBodyChars?: number }} [options]
+ * @returns {string} Markdown, always beginning with the sticky marker
+ */
+export function renderPrComment(results, options = {}) {
+  const list = Array.isArray(results) ? results : [];
+  const marker = options.marker ?? PR_COMMENT_MARKER;
+  const maxInlineChanges = options.maxInlineChanges ?? MAX_INLINE_CHANGES;
+  const maxBodyChars = options.maxBodyChars ?? MAX_BODY_CHARS;
+  const cwd = options.cwd;
+
+  const counts = { changed: 0, added: 0, removed: 0 };
+  const severityCounts = { error: 0, warn: 0, info: 0 };
+  /** @type {Record<string, Array<{ file: string, finding: import('./policy.js').PolicyFinding }>>} */
+  const bySeverity = { error: [], warn: [], info: [] };
+  let totalChanges = 0;
+
+  for (const result of list) {
+    const file = displayPath(result.file, cwd);
+    for (const change of changesOf(result)) {
+      totalChanges += 1;
+      if (change.type in counts) counts[change.type] += 1;
+    }
+    for (const finding of findingsOf(result)) {
+      const severity = SEVERITY_ORDER.includes(finding.severity) ? finding.severity : 'info';
+      severityCounts[severity] += 1;
+      bySeverity[severity].push({ file, finding });
+    }
+  }
+
+  const totalFindings = SEVERITY_ORDER.reduce((sum, s) => sum + severityCounts[s], 0);
+  const lines = [marker, '', '## Flecto — config change report', ''];
+
+  const status = options.failed === true
+    ? '❌ **Check failing** — '
+    : options.failed === false
+      ? '✅ **Check passing** — '
+      : '';
+
+  if (list.length === 0) {
+    lines.push(`${status}no files were diffed.`);
+  } else if (totalChanges === 0) {
+    lines.push(`${status}no semantic changes in ${plural(list.length, 'file')}.`);
+  } else {
+    lines.push(
+      `${status}${plural(totalChanges, 'change')} in ${plural(list.length, 'file')}` +
+      ` — ${counts.changed} changed, ${counts.added} added, ${counts.removed} removed.`,
+    );
+  }
+
+  lines.push('');
+  lines.push(totalFindings === 0
+    ? '**Policy:** no findings.'
+    : `**Policy:** ${SEVERITY_ORDER
+      .filter((severity) => severityCounts[severity] > 0)
+      .map((severity) => plural(severityCounts[severity], SEVERITY_NOUNS[severity]))
+      .join(', ')}.`);
+
+  if (totalFindings > 0) {
+    lines.push('', '### Policy findings');
+    for (const severity of SEVERITY_ORDER) {
+      const entries = bySeverity[severity];
+      if (entries.length === 0) continue;
+      lines.push('', `#### ${SEVERITY_HEADINGS[severity]} (${entries.length})`, '');
+      lines.push('| File | Path | Rule | Message |', '|---|---|---|---|');
+      for (const { file, finding } of entries) {
+        const rule = finding.pack
+          ? `${inlineCode(finding.id)} (${inlineCode(finding.pack)})`
+          : inlineCode(finding.id);
+        lines.push(
+          `| ${tableCell(inlineCode(file))} | ${tableCell(inlineCode(finding.path))}` +
+          ` | ${tableCell(rule)} | ${tableCell(finding.message ?? '')} |`,
+        );
+      }
+    }
+  }
+
+  if (totalChanges > 0) {
+    const collapse = totalChanges > maxInlineChanges;
+    lines.push('', '### Changes');
+    if (collapse) {
+      lines.push('', '<details>', `<summary>Show all ${plural(totalChanges, 'change')}</summary>`);
+    }
+    for (const result of list) {
+      const changes = changesOf(result);
+      if (changes.length === 0) continue;
+      const file = displayPath(result.file, cwd);
+      lines.push('', `**${inlineCode(file)}** — ${plural(changes.length, 'change')}`, '');
+      lines.push('| Change | Path | Before | After |', '|---|---|---|---|');
+      for (const change of changes) {
+        const kind = change.note ? `${change.type} (${change.note})` : String(change.type);
+        const before = formatValue(change.before);
+        const after = formatValue(change.after);
+        lines.push(
+          `| ${tableCell(kind)} | ${tableCell(inlineCode(change.path))}` +
+          ` | ${before === null ? '—' : tableCell(inlineCode(before))}` +
+          ` | ${after === null ? '—' : tableCell(inlineCode(after))} |`,
+        );
+      }
+    }
+    if (collapse) lines.push('', '</details>');
+  }
+
+  lines.push(
+    '',
+    '---',
+    '',
+    '<sub>Posted by [Flecto](https://github.com/myselfsiddharth/Flecto) —' +
+    ' this comment is updated in place on every run.</sub>',
+    '',
+  );
+
+  const body = lines.join('\n');
+  if (body.length <= maxBodyChars) return body;
+  const notice = '\n\n_Report truncated to fit GitHub\'s comment size limit._\n';
+  return `${body.slice(0, Math.max(marker.length, maxBodyChars - notice.length))}${notice}`;
+}
+
+/**
+ * @param {Record<string, string | undefined>} env
+ * @param {(path: string) => string} readEventFile
+ * @returns {number | null}
+ */
+function resolvePrNumber(env, readEventFile) {
+  const fromRef = /^refs\/pull\/(\d+)\/(?:merge|head)$/u.exec(env.GITHUB_REF ?? '');
+  if (fromRef) return Number(fromRef[1]);
+
+  const eventPath = env.GITHUB_EVENT_PATH;
+  if (!eventPath) return null;
+
+  let event;
+  try {
+    event = JSON.parse(readEventFile(eventPath));
+  } catch {
+    return null;
+  }
+
+  const candidates = [
+    event?.pull_request?.number,
+    // issue_comment events on a PR carry the PR number under `issue`, but a
+    // plain issue must not be mistaken for one.
+    event?.issue?.pull_request ? event?.issue?.number : undefined,
+    event?.number,
+  ];
+  for (const candidate of candidates) {
+    const value = Number(candidate);
+    if (Number.isInteger(value) && value > 0) return value;
+  }
+  return null;
+}
+
+/**
+ * Resolve the GitHub API context needed to post a pull request comment.
+ *
+ * Only `GITHUB_TOKEN` is honored — `GH_TOKEN` is deliberately ignored because
+ * `gh auth login` exports it on developer machines, where posting would be a
+ * surprise.
+ * @param {Record<string, string | undefined>} [env]
+ * @param {{ readEventFile?: (path: string) => string }} [options]
+ * @returns {{ ok: true, context: PrCommentContext } | { ok: false, reason: string }}
+ */
+export function resolvePrCommentContext(env = process.env, options = {}) {
+  const readEventFile = options.readEventFile ?? ((path) => readFileSync(path, 'utf8'));
+  const token = String(env.GITHUB_TOKEN ?? '').trim();
+  if (!token) {
+    return { ok: false, reason: 'GITHUB_TOKEN is not set' };
+  }
+
+  const repo = String(env.GITHUB_REPOSITORY ?? '').trim();
+  if (!/^[^/\s]+\/[^/\s]+$/u.test(repo)) {
+    return { ok: false, reason: 'GITHUB_REPOSITORY is not set to "owner/repo"' };
+  }
+
+  const prNumber = resolvePrNumber(env, readEventFile);
+  if (!prNumber) {
+    return {
+      ok: false,
+      reason: 'no pull request number in GITHUB_REF or GITHUB_EVENT_PATH (not a pull request run)',
+    };
+  }
+
+  const apiUrl = String(env.GITHUB_API_URL || DEFAULT_API_URL).replace(/\/+$/u, '');
+  return { ok: true, context: { repo, prNumber, token, apiUrl } };
+}
+
+/**
+ * Remove the token from text that may be surfaced to the user.
+ * @param {string} text
+ * @param {string} token
+ * @returns {string}
+ */
+function redact(text, token) {
+  return token ? String(text).replaceAll(token, '***') : String(text);
+}
+
+/**
+ * @param {Response} response
+ * @param {string} token
+ * @returns {Promise<string>}
+ */
+async function errorDetail(response, token) {
+  let text = '';
+  try {
+    text = await response.text();
+  } catch {
+    return '';
+  }
+  let message = text;
+  try {
+    const parsed = JSON.parse(text);
+    if (typeof parsed?.message === 'string') message = parsed.message;
+  } catch {
+    // Non-JSON error bodies are used as-is.
+  }
+  const safe = truncate(redact(message, token).replaceAll(/\s+/gu, ' ').trim(), 200);
+  return safe ? `: ${safe}` : '';
+}
+
+/**
+ * @param {{ fetchImpl: typeof fetch, url: string, method: string, token: string, body?: unknown, timeoutMs: number }} request
+ * @returns {Promise<Response>}
+ */
+async function githubRequest({ fetchImpl, url, method, token, body, timeoutMs }) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method,
+      headers: {
+        Accept: 'application/vnd.github+json',
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        'User-Agent': 'flecto',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+      signal: controller.signal,
+    });
+  } catch (err) {
+    const reason = err?.name === 'AbortError'
+      ? `timed out after ${timeoutMs}ms`
+      : redact(err?.message ?? String(err), token);
+    throw new Error(`GitHub API ${method} failed: ${reason}`);
+  } finally {
+    clearTimeout(timer);
+  }
+
+  if (!response.ok) {
+    throw new Error(
+      `GitHub API ${method} returned HTTP ${response.status}${await errorDetail(response, token)}`,
+    );
+  }
+  return response;
+}
+
+/**
+ * Find the sticky Flecto comment on a pull request, if one exists.
+ * @param {PrCommentContext} context
+ * @param {{ fetchImpl: typeof fetch, marker: string, timeoutMs: number }} options
+ * @returns {Promise<{ id: number, body?: string, html_url?: string } | null>}
+ */
+async function findStickyComment(context, { fetchImpl, marker, timeoutMs }) {
+  for (let page = 1; page <= MAX_COMMENT_PAGES; page += 1) {
+    const url = `${context.apiUrl}/repos/${context.repo}/issues/${context.prNumber}`
+      + `/comments?per_page=${COMMENTS_PER_PAGE}&page=${page}`;
+    const response = await githubRequest({
+      fetchImpl, url, method: 'GET', token: context.token, timeoutMs,
+    });
+    const comments = await response.json();
+    if (!Array.isArray(comments) || comments.length === 0) return null;
+    const match = comments.find((c) => typeof c?.body === 'string' && c.body.includes(marker));
+    if (match) return match;
+    if (comments.length < COMMENTS_PER_PAGE) return null;
+  }
+  return null;
+}
+
+/**
+ * Create, update, or leave alone the single sticky Flecto comment on a PR.
+ * Throws on API failure; callers decide how to degrade.
+ * @param {string} body Markdown containing the sticky marker
+ * @param {PrCommentContext} context
+ * @param {{ fetchImpl?: typeof fetch, marker?: string, timeoutMs?: number }} [options]
+ * @returns {Promise<{ action: 'created' | 'updated' | 'unchanged', url?: string }>}
+ */
+export async function upsertPrComment(body, context, options = {}) {
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const marker = options.marker ?? PR_COMMENT_MARKER;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (typeof fetchImpl !== 'function') {
+    throw new Error('Global fetch unavailable. Use Node.js >= 20.19.0.');
+  }
+
+  const existing = await findStickyComment(context, { fetchImpl, marker, timeoutMs });
+
+  if (!existing) {
+    const response = await githubRequest({
+      fetchImpl,
+      url: `${context.apiUrl}/repos/${context.repo}/issues/${context.prNumber}/comments`,
+      method: 'POST',
+      token: context.token,
+      body: { body },
+      timeoutMs,
+    });
+    const created = await response.json().catch(() => ({}));
+    return { action: 'created', url: created?.html_url };
+  }
+
+  // Rendering is deterministic, so an identical body means nothing moved since
+  // the last run — skip the write and the "edited" noise it creates.
+  if (existing.body === body) {
+    return { action: 'unchanged', url: existing.html_url };
+  }
+
+  const response = await githubRequest({
+    fetchImpl,
+    url: `${context.apiUrl}/repos/${context.repo}/issues/comments/${existing.id}`,
+    method: 'PATCH',
+    token: context.token,
+    body: { body },
+    timeoutMs,
+  });
+  const updated = await response.json().catch(() => ({}));
+  return { action: 'updated', url: updated?.html_url ?? existing.html_url };
+}
+
+/**
+ * Post the sticky comment when — and only when — posting was explicitly enabled
+ * and a complete GitHub pull request context is present.
+ *
+ * Never throws and never reports the token: a delivery problem must not change
+ * the CI exit code, which belongs to the diff and policy result alone.
+ * @param {string} body
+ * @param {{
+ *   enabled?: boolean,
+ *   env?: Record<string, string | undefined>,
+ *   fetchImpl?: typeof fetch,
+ *   marker?: string,
+ *   timeoutMs?: number,
+ *   readEventFile?: (path: string) => string
+ * }} [options]
+ * @returns {Promise<{ posted: boolean, action?: 'created' | 'updated' | 'unchanged', url?: string, reason?: string }>}
+ */
+export async function deliverPrComment(body, options = {}) {
+  if (!options.enabled) {
+    return { posted: false, reason: 'posting is disabled (pass --pr-comment-post to enable)' };
+  }
+
+  const resolved = resolvePrCommentContext(options.env ?? process.env, options);
+  if (!resolved.ok) {
+    return { posted: false, reason: resolved.reason };
+  }
+
+  try {
+    const result = await upsertPrComment(body, resolved.context, options);
+    return { posted: true, ...result };
+  } catch (err) {
+    return {
+      posted: false,
+      reason: redact(err?.message ?? String(err), resolved.context.token),
+    };
+  }
+}

package/src/renderer.js

@@ -1,5 +1,18 @@
 import chalk from 'chalk';
+import { redactSecretString } from './secrets.js';
+import { ENCRYPTED_DISPLAY, displayEncrypted, isEncryptedSentinel } from './encrypted.js';
+import { secretMatchPath } from './differ.js';
 
+/**
+ * Key names that mean "this value is a credential".
+ *
+ * Matched against the *configuration* path only. A multi-document file prefixes
+ * every path with the document's identity — `Deployment/prod/token-service.…` —
+ * and that identity is a resource name the user chose, not a key name. Letting
+ * it match here masked every value in the document, numbers and booleans
+ * included, so the path reaching this regex is always the one
+ * {@link secretMatchPath} produced.
+ */
 const SECRET_PATH_RE = /(secret|token|password|api[_-]?key|private[_-]?key|credential)/i;
 
 /**
@@ -10,12 +23,22 @@ const SECRET_PATH_RE = /(secret|token|password|api[_-]?key|private[_-]?key|crede
  */
 function fmt(v, opts = {}) {
   if (v === undefined) return '';
-  if (opts.maskSecrets && opts.path && SECRET_PATH_RE.test(opts.path)) {
-    return chalk.dim('"***"');
+  // An encrypted value reads the same masked or not: there is nothing to mask,
+  // because the parser never carried the ciphertext this far.
+  if (isEncryptedSentinel(v)) return chalk.dim(ENCRYPTED_DISPLAY);
+  let value = displayEncrypted(v);
+  if (opts.maskSecrets) {
+    if (opts.path && SECRET_PATH_RE.test(opts.path)) {
+      return chalk.dim('"***"');
+    }
+    // The changed path itself can look benign while the value carries secrets,
+    // e.g. "database" holding { password }. Redact those the same way the
+    // webhook/CI payloads do.
+    value = maskSensitiveValue(value, opts.path ?? '');
   }
-  if (typeof v === 'string') return JSON.stringify(v);
-  if (typeof v === 'object' && v !== null) return JSON.stringify(v);
-  return String(v);
+  if (typeof value === 'string') return JSON.stringify(value);
+  if (typeof value === 'object' && value !== null) return JSON.stringify(value);
+  return String(value);
 }
 
 /**
@@ -35,23 +58,38 @@ function timestamp() {
  */
 function renderEvent(event, mode, opts = {}) {
   const { type, path, before, after, note } = event;
-  const maskOpts = { maskSecrets: Boolean(opts.maskSecrets), path };
+  // The full path is what gets printed; the stripped one is what secret-name
+  // matching is allowed to see.
+  const maskOpts = { maskSecrets: Boolean(opts.maskSecrets), path: secretMatchPath(event) };
+  // Notes ride on every change type — a Terraform plan explains a create or a
+  // destroy there. The tree differ only ever notes changed events, so existing
+  // added/removed output is unaffected.
+  const noteStr = note ? chalk.dim(` [${note}]`) : '';
 
   if (type === 'added') {
-    const line = `  ${chalk.green('+')} ${chalk.green(path)}: ${chalk.green(fmt(after, maskOpts))}`;
+    const line = `  ${chalk.green('+')} ${chalk.green(path)}: ${chalk.green(fmt(after, maskOpts))}${noteStr}`;
     return mode === 'verbose'
       ? `${line}\n    ${chalk.dim('(key added)')}`
       : line;
   }
 
   if (type === 'removed') {
-    const line = `  ${chalk.red('-')} ${chalk.red(path)}: ${chalk.red(fmt(before, maskOpts))}`;
+    const line = `  ${chalk.red('-')} ${chalk.red(path)}: ${chalk.red(fmt(before, maskOpts))}${noteStr}`;
     return mode === 'verbose'
       ? `${line}\n    ${chalk.dim('(key removed)')}`
       : line;
   }
 
-  const noteStr = note ? chalk.dim(` [${note}]`) : '';
+  // Both sides ciphertext: the only honest thing to say is that it moved.
+  // Printing the two sentinels would be noise, and printing what they stand for
+  // is not something Flecto can do or wants to be able to do.
+  if (isEncryptedSentinel(before) && isEncryptedSentinel(after)) {
+    const line = `  ${chalk.yellow('~')} ${chalk.yellow(path)}: ${chalk.dim('<encrypted value changed>')}`;
+    return mode === 'verbose'
+      ? `${line}\n    ${chalk.dim('(Flecto never decrypts — only that the ciphertext differs is known)')}`
+      : line;
+  }
+
   if (mode === 'verbose') {
     return [
       `  ${chalk.yellow('~')} ${chalk.yellow(path)}${noteStr}`,
@@ -85,18 +123,22 @@ export function renderChanges(filepath, events, mode = 'compact', opts = {}) {
 }
 
 /**
- * Print a diff result (for --diff mode) to stdout.
+ * Print a diff result (for `watch --diff` and `compare`) to stdout.
+ * `baseline` names the side the events are measured from, so a cross-file
+ * comparison reads unambiguously; it defaults to the saved snapshot.
  * @param {string} filepath
  * @param {import('./differ.js').ChangeEvent[]} events
- * @param {{ maskSecrets?: boolean }} [opts]
+ * @param {{ maskSecrets?: boolean, baseline?: string }} [opts]
  */
 export function renderDiff(filepath, events, opts = {}) {
+  const baseline = opts.baseline ?? 'snapshot';
+
   if (events.length === 0) {
-    console.log(chalk.green(`✓ ${filepath} matches snapshot — no changes`));
+    console.log(chalk.green(`✓ ${filepath} matches ${baseline} — no changes`));
     return;
   }
 
-  console.log(chalk.cyan(`${filepath}`) + ` — ${events.length} change${events.length !== 1 ? 's' : ''} from snapshot:`);
+  console.log(chalk.cyan(`${filepath}`) + ` — ${events.length} change${events.length !== 1 ? 's' : ''} from ${baseline}:`);
   for (const event of events) {
     console.log(renderEvent(event, 'compact', opts));
   }
@@ -126,6 +168,14 @@ export function renderInfo(msg) {
   console.log(chalk.dim(msg));
 }
 
+/**
+ * Print a dim status note on stderr, so it stays out of machine-readable stdout.
+ * @param {string} msg
+ */
+export function renderNote(msg) {
+  console.error(chalk.dim(msg));
+}
+
 /**
  * Print policy findings.
  * @param {import('./policy.js').PolicyFinding[]} findings
@@ -144,7 +194,9 @@ export function renderPolicyFindings(findings) {
 }
 
 /**
- * Mask secret-like values in a plain object tree for CI output.
+ * Mask secret-like values in a plain object tree for CI output. A value is
+ * masked when its path looks secret, or — see secrets.js — when the value
+ * itself does, which covers credentials stored under innocuous key names.
  * @param {unknown} value
  * @param {string} [path]
  * @returns {unknown}
@@ -167,6 +219,7 @@ export function maskSensitiveValue(value, path = '') {
     }
     return out;
   }
+  if (typeof value === 'string') return redactSecretString(value);
   return value;
 }
 
@@ -175,9 +228,10 @@ export function maskSensitiveValue(value, path = '') {
  * @returns {import('./differ.js').ChangeEvent}
  */
 export function maskChangeEvent(event) {
+  const path = secretMatchPath(event);
   return {
     ...event,
-    before: event.before === undefined ? undefined : maskSensitiveValue(event.before, event.path),
-    after: event.after === undefined ? undefined : maskSensitiveValue(event.after, event.path),
+    before: event.before === undefined ? undefined : maskSensitiveValue(event.before, path),
+    after: event.after === undefined ? undefined : maskSensitiveValue(event.after, path),
   };
 }