fix(ci): redact dash-prefixed secret values (D-1133, D-1483)

free/ci/internal/adhoc/argv.go

@@ -34,7 +34,8 @@ func secretValues(argv []string) [][]byte {
 		switch {
 		case hasValue && value != "":
 			out = append(out, []byte(value))
-		case !hasValue && strings.HasPrefix(a, "-") && i+1 < len(argv) && !strings.HasPrefix(argv[i+1], "-"):
+		case !hasValue && strings.HasPrefix(a, "-") && i+1 < len(argv):
+			// A secret value may itself begin with a dash.
 			out = append(out, []byte(argv[i+1]))
 		}
 	}

free/ci/internal/adhoc/argv_test.go

@@ -42,3 +42,33 @@ func TestRecordedArgvIsBounded(t *testing.T) {
 		t.Fatalf("recorded %d bytes", len(got))
 	}
 }
+
+func TestDashPrefixedSecretValuesAreRedacted(t *testing.T) {
+	for _, secret := range []string{"-randomValue123", "--randomValue123", "-x"} {
+		t.Run(secret, func(t *testing.T) {
+			argv := []string{"deploy", "--password", secret, "--verbose"}
+			if got := Recorded(redact.New(), argv); got != "deploy --password [redacted] --verbose" {
+				t.Errorf("recorded argv before registration = %q", got)
+			}
+			r := redact.New()
+			tooShort := Register(r, argv)
+			if len(secret) < redact.MinValueLen {
+				if tooShort != 1 {
+					t.Errorf("short secret count = %d, want 1", tooShort)
+				}
+				return
+			}
+			if tooShort != 0 {
+				t.Fatalf("short secret count = %d, want 0", tooShort)
+			}
+			if got := Recorded(r, argv); got != "deploy --password [redacted] --verbose" {
+				t.Errorf("recorded argv after registration = %q", got)
+			}
+			f := r.NewFilter()
+			got := string(append(f.Redact([]byte("line "+secret+" end\n")), f.Flush()...))
+			if strings.Contains(got, secret) || !strings.Contains(got, redact.Placeholder) {
+				t.Errorf("job output was not redacted: %q", got)
+			}
+		})
+	}
+}