-
Notifications
You must be signed in to change notification settings - Fork 89
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Add audit log output #111
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm concerned about the handling of the case where a salt has not been provided. As far as I can tell this would mean the hash(value, "") would show up in the logs.
Following up on this to see what your thoughts are? |
ae4b571
to
bad1d82
Compare
You are right, the unsalted hashed value is printed in the logs. |
Adds the
audit_log
output parameter that captures audit log information in a list of JSON objects. Fixes #110An audit log object contains the following properties:
repo
: stringtarget
: stringaction
: stringsecret_name
: stringsecret_hash
: stringenvironment
: stringdry_run
: booleanThe
secret_hash
contains the hashed password. This can be used to track whether a secret actually changes.Optionally, a custom salt can be provided via the
audit_log_hashing_salt
to make it more difficult to reverse engineer the secret.This functionality might be a bit specific for our project's needs. If it is useful for the greater public, feel free to merge. It does not introduce any breaking changes.