Plugin implementing a listener to mask secrets in the console?

[Cyrille Le Clerc]

Dear community,

In the Jenkins OpenTelemetry plugin, we want to optionally inject in shell & bat steps some OpenTelemetry configuration environment variables that contains secrets and we would like to mask those credentials in the console the same way the `withCredentials` step does it.

We identified that the `withCredentials` step creates a new BodyInvoker on `o.j.p.w.steps.StepExecution#start()` (see here).

Is it possible implementing a `o.j.p.w.flow.StepListener#notifyOfNewStep()` or `o.j.p.w.flow.GraphListener#onNewHead()` to mask passwords in shell & bat steps? Are their limitations that would prevent it?

Implementing `StepListener#notifyOfNewStep(step, stepContext)` seems to provide access to the needed `stepContent`.

Cyrille

[Jesse Glick]

https://javadoc.jenkins.io/plugin/workflow-api/org/jenkinsci/plugins/workflow/log/TaskListenerDecorator.Factory.html might work for this purpose.