Skip to main content

ci.mask

The ci.mask function registers a value as a secret. Everything Atmos prints afterwards redacts it, and in CI the runner redacts it from its own logs too.

Usage​

ci.mask(value)

Arguments​

value
Required. The sensitive value to redact, as a string.

Returns​

The return value is None.

Behavior​

  • The value is registered with Atmos output masking immediately, so every line printed after the call redacts it. This includes ui.*, print, summaries, comments, and the output of later commands.
  • When ci.enabled is true and a CI provider is detected, the call also emits the runner's mask command, so the runner redacts the value from its logs, including the output of steps that run after the script. The runner command goes to stderr, so it never mixes into data a script prints to stdout.
  • Masking applies from the call onward. Text that was already printed is not changed, so mask a value before you print it.
  • The value still reaches ci.output and ci.env unchanged, so later steps can use it.
  • Atmos's own masking is not gated by any flag, because masking is a safety measure. Only the runner's mask command depends on ci.enabled: with ci.enabled off, Atmos output still redacts the value, but the runner does not.

Examples​

Mask a token before using it​

token = exec.run(["vault", "read", "-field=token", "secret/ci"], output = "capture").stdout.strip()
ci.mask(token)
ui.info("Fetched token " + token)

The message prints with the token redacted.

Mask and export a value for later steps​

password = exec.run(["pwgen", "32", "1"], output = "capture").stdout.strip()
ci.mask(password)
ci.env("DB_PASSWORD", password)

Errors​

  • A missing or non-string value fails with an argument error that names ci.mask.

Related​

  • ci describes the module and explains masking.
  • exec.run with output = "capture" keeps secret-bearing output off the screen.