Summary

This came up on Discord, from a user including Taskfiles from a private GitLab repository.

Including a Taskfile from a private repository may mean putting a token in the URL:

version: '3'

includes:
  lint: https://gitlab.com/api/v4/projects/1234/repository/files/Taskfile.yml/raw?ref=main&private_token={{.CI_JOB_TOKEN}}

Task prints that URL in full every time it shows it: download errors, the trust prompt, and --verbose output, which on CI means build logs.

task: Download of "https://gitlab.com/.../raw?ref=main&private_token=glpat-xxxxxxxx" failed

What we could try first:

version: '3'

vars:
  TOKEN:
    value: '{{.CI_JOB_TOKEN}}'
    secret: true

includes:
  lint: https://gitlab.com/.../raw?ref=main&private_token={{.TOKEN}}

Neither half of this works:

• Includes are resolved before variables are compiled, so {{.TOKEN}} is replaced by the literal string {{.CI_JOB_TOKEN}} rather than the token. Only environment variables and static Taskfile variables are available at that point.
• And secret: true only masks logged commands, task --summary and command output, never the include URL.

So the credential has to be referenced directly, private_token={{.CI_JOB_TOKEN}}, which is exactly the form that leaks.

url.Redacted() does not cover it either. It masks the password of the userinfo, so https://user:{{.TOKEN}}@host/... is handled but not https://{{.TOKEN}}@host/..., the form our own docs recommend, where the token is the username. Query parameters are never touched either.

Why not just mask every variable in the URL

Because most of them are worth reading. A typical GitLab URL carries {{.CI_PROJECT_ID}}, {{.CI_COMMIT_REF_NAME}} and {{.CI_JOB_TOKEN}}, three variables, one secret.

What can we do ?

An explicit list of variable names to hide, configured next to trusted-hosts:

# .taskrc.yml
remote:
  mask-vars:
    - CI_JOB_TOKEN

with TASK_REMOTE_MASK_VARS as equivalent.

task: Download of "https://gitlab.com/.../raw?ref=main&private_token=*****" failed