# ci.mask

The `ci.mask` function registers a value as a secret. Everything Atmos prints afterwards redacts it, and in CI the
runner redacts it from its own logs too.

## Usage

```python
ci.mask(value)
```

## Arguments

- **`value`**
  Required. The sensitive value to redact, as a string.

## Returns

The return value is `None`.

## Behavior

- The value is registered with Atmos output masking immediately, so every line printed after the call redacts it. This
  includes `ui.*`, `print`, summaries, comments, and the output of later commands.
- When [`ci.enabled`](/cli/configuration/ci) is true and a CI provider is detected, the call also emits the runner's
  mask command, so the runner redacts the value from its logs, including the output of steps that run after the script.
  The runner command goes to stderr, so it never mixes into data a script prints to stdout.
- Masking applies from the call onward. Text that was already printed is not changed, so mask a value before you print it.
- The value still reaches [`ci.output`](/functions/automation/ci.output) and [`ci.env`](/functions/automation/ci.env)
  unchanged, so later steps can use it.
- Atmos's own masking is not gated by any flag, because masking is a safety measure. Only the runner's mask command
  depends on `ci.enabled`: with `ci.enabled` off, Atmos output still redacts the value, but the runner does not.

## Examples

### Mask a token before using it

```python
token = exec.run(["vault", "read", "-field=token", "secret/ci"], output = "capture").stdout.strip()
ci.mask(token)
ui.info("Fetched token " + token)
```

The message prints with the token redacted.

### Mask and export a value for later steps

```python
password = exec.run(["pwgen", "32", "1"], output = "capture").stdout.strip()
ci.mask(password)
ci.env("DB_PASSWORD", password)
```

## Errors

- A missing or non-string `value` fails with an argument error that names `ci.mask`.

## Related

- [`ci`](/functions/automation/ci) describes the module and explains [masking](/functions/automation/ci#masking).
- [`exec.run`](/functions/automation/exec.run) with `output = "capture"` keeps secret-bearing output off the screen.