fix(trace): use CHAINLOOP_TRACE_REDACTED as the redaction placeholder (#3574)

Author: migmartri

app/cli/internal/policydevel/eval_test.go

@@ -301,7 +301,7 @@ func TestEvaluateReadsRedactedMaterial(t *testing.T) {
 			for _, input := range result.DebugInfo.Inputs {
 				assert.NotContains(t, string(input), fixtureGitHubPAT,
 					"the policy engine must never receive the un-redacted credential")
-				assert.Contains(t, string(input), "[REDACTED:")
+				assert.Contains(t, string(input), "[CHAINLOOP_TRACE_REDACTED:")
 			}
 		})
 	}

app/cli/internal/policydevel/testdata/ai-coding-session-no-secrets-policy.yaml

@@ -17,7 +17,7 @@ spec:
         # replaced it. Unanchored counterpart of
         # internal/redaction.IsDefaultPlaceholder.
         violations contains msg if {
-            regex.match(`\[REDACTED(:[^\]\s]*)?\]`, json.marshal(input))
+            regex.match(`\[CHAINLOOP_TRACE_REDACTED(:[^\]\s]*)?\]`, json.marshal(input))
             msg := "secrets were found and redacted in the coding session"
         }
 

app/cli/internal/trace/skill/skill_test.go

@@ -100,17 +100,17 @@ func TestCopyAndPackage(t *testing.T) {
 		assert.True(t, strings.HasPrefix(info.Digest, "sha256:"))
 
 		redact := func(doc []byte) ([]byte, error) {
-			return bytes.ReplaceAll(doc, []byte("SECRET"), []byte("[REDACTED]")), nil
+			return bytes.ReplaceAll(doc, []byte("SECRET"), []byte("[CHAINLOOP_TRACE_REDACTED]")), nil
 		}
 
 		pkg, err := MakePackage(dst, redact)
 		require.NoError(t, err)
 
-		assert.Equal(t, "# Skill\nuse token [REDACTED]\n", string(pkg.Definition))
+		assert.Equal(t, "# Skill\nuse token [CHAINLOOP_TRACE_REDACTED]\n", string(pkg.Definition))
 		assert.Equal(t, map[string]string{
-			DefinitionFile:              "# Skill\nuse token [REDACTED]\n",
+			DefinitionFile:              "# Skill\nuse token [CHAINLOOP_TRACE_REDACTED]\n",
 			"references/rules.md":       "the rules",
-			"scripts/lint.py":           "print('[REDACTED]')",
+			"scripts/lint.py":           "print('[CHAINLOOP_TRACE_REDACTED]')",
 			"examples/before-after.txt": "before and after",
 		}, archiveFiles(t, pkg.Archive), "version-control folders and files are left out")
 	})

app/cli/pkg/action/trace_spec_materials_test.go

@@ -188,8 +188,8 @@ func TestAttachSpecs(t *testing.T) {
 		require.Len(t, adder.added, 1)
 		// The address is scanned like the text: a token in a URL must not
 		// survive in the stored file, the annotation or the reference.
-		wantURI := "https://tracker.example.com/issue/1?token=[REDACTED:github-pat]"
-		assert.Equal(t, "---\nkind: ticket\nuri: "+wantURI+"\n---\nconfigured with the token [REDACTED:github-pat] and still a 401", adder.added[0].content)
+		wantURI := "https://tracker.example.com/issue/1?token=[CHAINLOOP_TRACE_REDACTED:github-pat]"
+		assert.Equal(t, "---\nkind: ticket\nuri: "+wantURI+"\n---\nconfigured with the token [CHAINLOOP_TRACE_REDACTED:github-pat] and still a 401", adder.added[0].content)
 		assert.Equal(t, wantURI, adder.added[0].annotations[specAnnotationURI])
 		require.Len(t, entries, 1)
 		assert.Equal(t, wantURI, entries[0].URI)
@@ -306,8 +306,8 @@ func TestAttachSpecs(t *testing.T) {
 		entries, _, _, _ := attachSpecs(context.Background(), adder, newSpecRedactor(t.TempDir()), materials.NewNameAllocator(nil), sessionID, []spec.Capture{withSecret}, zerolog.Nop())
 
 		require.Len(t, entries, 1)
-		assert.Equal(t, "token [REDACTED:github-pat] fails", entries[0].Title)
-		assert.Equal(t, "uses [REDACTED:github-pat]", entries[0].Description)
+		assert.Equal(t, "token [CHAINLOOP_TRACE_REDACTED:github-pat] fails", entries[0].Title)
+		assert.Equal(t, "uses [CHAINLOOP_TRACE_REDACTED:github-pat]", entries[0].Description)
 		assert.Equal(t, entries[0].Title, adder.added[0].annotations[specAnnotationTitle])
 		assert.Equal(t, entries[0].Description, adder.added[0].annotations[specAnnotationDescription])
 	})
@@ -328,7 +328,7 @@ func TestAttachSpecs(t *testing.T) {
 		assert.Equal(t, string(pngBytes), adder.added[0].content, "the binary file is still stored as it is")
 		require.Len(t, entries, 1)
 		assert.Equal(t, aicodingsession.SpecRoleReference, entries[0].Role)
-		assert.Equal(t, "mockup for [REDACTED:github-pat]", entries[0].Title)
+		assert.Equal(t, "mockup for [CHAINLOOP_TRACE_REDACTED:github-pat]", entries[0].Title)
 		assert.Equal(t, "Where the button goes.", entries[0].Description)
 		assert.Equal(t, aicodingsession.SpecRoleReference, adder.added[0].annotations[specAnnotationRole])
 		assert.Equal(t, entries[0].Title, adder.added[0].annotations[specAnnotationTitle])
@@ -482,6 +482,6 @@ func TestSpecRedactor(t *testing.T) {
 	t.Run("the default scanner removes secrets", func(t *testing.T) {
 		got, err := newSpecRedactor(t.TempDir()).Redact(context.Background(), []byte("the token "+pat+" fails"))
 		require.NoError(t, err)
-		assert.Equal(t, "the token [REDACTED:github-pat] fails", string(got))
+		assert.Equal(t, "the token [CHAINLOOP_TRACE_REDACTED:github-pat] fails", string(got))
 	})
 }

internal/redaction/betterleaks_test.go

@@ -153,7 +153,7 @@ func TestDefaultPlaceholderIsNotDetectable(t *testing.T) {
 	for id := range cfg.Rules {
 		ruleIDs = append(ruleIDs, id)
 	}
-	// The empty rule id yields the bare "[REDACTED]" placeholder.
+	// The empty rule id yields the bare "[CHAINLOOP_TRACE_REDACTED]" placeholder.
 	ruleIDs = append(ruleIDs, "")
 
 	for _, id := range ruleIDs {
@@ -270,7 +270,7 @@ func TestRedactCredentialInURIConverges(t *testing.T) {
 	require.NoError(t, err)
 	require.True(t, report.Changed())
 	assert.NotContains(t, string(once), fakeGitHubPAT)
-	assert.Contains(t, string(once), "[REDACTED:github-pat]")
+	assert.Contains(t, string(once), "[CHAINLOOP_TRACE_REDACTED:github-pat]")
 	// Two passes: one that redacts, one that confirms nothing is left.
 	assert.Equal(t, 2, report.Passes)
 
@@ -301,29 +301,29 @@ func TestRedactJWTKeepsSurroundingText(t *testing.T) {
 			// the JWT is escaped in the leaf.
 			name: "followed by an escaped quote in a nested JSON string",
 			leaf: `{"url":"https://uploads.example.com/o/a/b?signature=` + fakeJWT + `"}`,
-			want: `{"url":"https://uploads.example.com/o/a/b?signature=[REDACTED:jwt]"}`,
+			want: `{"url":"https://uploads.example.com/o/a/b?signature=[CHAINLOOP_TRACE_REDACTED:jwt]"}`,
 		},
 		{
 			name: "followed by an escaped newline",
 			leaf: "https://uploads.example.com/o/a/b?signature=" + fakeJWT + "\nnext line",
-			want: "https://uploads.example.com/o/a/b?signature=[REDACTED:jwt]\nnext line",
+			want: "https://uploads.example.com/o/a/b?signature=[CHAINLOOP_TRACE_REDACTED:jwt]\nnext line",
 		},
 		{
 			name: "followed by an escaped carriage return",
 			leaf: "https://uploads.example.com/o/a/b?signature=" + fakeJWT + "\rnext line",
-			want: "https://uploads.example.com/o/a/b?signature=[REDACTED:jwt]\rnext line",
+			want: "https://uploads.example.com/o/a/b?signature=[CHAINLOOP_TRACE_REDACTED:jwt]\rnext line",
 		},
 		{
 			name: "followed by an escaped tab",
 			leaf: "https://uploads.example.com/o/a/b?signature=" + fakeJWT + "\tnext line",
-			want: "https://uploads.example.com/o/a/b?signature=[REDACTED:jwt]\tnext line",
+			want: "https://uploads.example.com/o/a/b?signature=[CHAINLOOP_TRACE_REDACTED:jwt]\tnext line",
 		},
 		{
 			// The literal backslash is a complete `\\` escape, which is kept in
 			// the secret: the leaf loses that one character but not its context.
 			name: "followed by a literal backslash",
 			leaf: `https://uploads.example.com/o/a/b?signature=` + fakeJWT + `\"`,
-			want: `https://uploads.example.com/o/a/b?signature=[REDACTED:jwt]"`,
+			want: `https://uploads.example.com/o/a/b?signature=[CHAINLOOP_TRACE_REDACTED:jwt]"`,
 		},
 	}
 
@@ -745,7 +745,7 @@ func TestLineSpansRoundTrip(t *testing.T) {
 func TestDocumentScannerMatchesFreshScan(t *testing.T) {
 	replaceFirst := func(text string) string {
 		i := strings.Index(text, "ghp_")
-		return text[:i] + "[REDACTED:github-pat]" + text[i+len(fakeGitHubPAT):]
+		return text[:i] + "[CHAINLOOP_TRACE_REDACTED:github-pat]" + text[i+len(fakeGitHubPAT):]
 	}
 
 	testCases := []struct {
@@ -802,7 +802,7 @@ func TestDocumentScannerRescansOnlyChangedChunks(t *testing.T) {
 	require.NoError(t, err)
 
 	i := strings.Index(text, "ghp_")
-	edited := text[:i] + "[REDACTED:github-pat]" + text[i+len(fakeGitHubPAT):]
+	edited := text[:i] + "[CHAINLOOP_TRACE_REDACTED:github-pat]" + text[i+len(fakeGitHubPAT):]
 
 	before := scanner.detector.TotalBytes.Load()
 	_, err = doc.Scan(context.Background(), edited)

internal/redaction/redaction.go

@@ -207,14 +207,14 @@ func New(s Scanner, opts ...Option) *Redactor {
 // present without being able to recover it.
 func DefaultPlaceholder(ruleID string) string {
 	if ruleID == "" {
-		return "[REDACTED]"
+		return "[CHAINLOOP_TRACE_REDACTED]"
 	}
-	return "[REDACTED:" + ruleID + "]"
+	return "[CHAINLOOP_TRACE_REDACTED:" + ruleID + "]"
 }
 
 // defaultPlaceholderPattern recognises the output of DefaultPlaceholder for any
 // rule id, including ids this build has never seen.
-var defaultPlaceholderPattern = regexp.MustCompile(`^\[REDACTED(?::[^\]\s]*)?\]$`)
+var defaultPlaceholderPattern = regexp.MustCompile(`^\[CHAINLOOP_TRACE_REDACTED(?::[^\]\s]*)?\]$`)
 
 // IsDefaultPlaceholder reports whether s is a placeholder DefaultPlaceholder
 // could have produced.

internal/redaction/redaction_test.go

@@ -116,7 +116,7 @@ func TestRedact(t *testing.T) {
 			wantReplacements: 1,
 			wantByRule:       map[string]int{"aws-access-token": 1},
 			mustNotContain:   []string{"FAKE-AWS-KEY-NOT-A-REAL-PATTERN"},
-			mustContain:      []string{"[REDACTED:aws-access-token]", "untouched", "run ", " now"},
+			mustContain:      []string{"[CHAINLOOP_TRACE_REDACTED:aws-access-token]", "untouched", "run ", " now"},
 		},
 		{
 			name:             "same secret across three leaves",
@@ -148,23 +148,23 @@ func TestRedact(t *testing.T) {
 			findings:         []Finding{{RuleID: "r1", Secret: "nSEC"}},
 			wantReplacements: 1,
 			mustNotContain:   []string{"before", "after"},
-			mustContain:      []string{"[REDACTED:r1]"},
+			mustContain:      []string{"[CHAINLOOP_TRACE_REDACTED:r1]"},
 		},
 		{
 			name:             "secret ending on the backslash of an escape keeps the leaf",
 			doc:              `{"a":"{\"url\":\"https://h/x?sig=SEC\"}"}`,
 			findings:         []Finding{{RuleID: "r1", Secret: `SEC\`}},
 			wantReplacements: 1,
 			wantByRule:       map[string]int{"r1": 1},
-			mustContain:      []string{`{"a":"{\"url\":\"https://h/x?sig=[REDACTED:r1]\"}"}`},
+			mustContain:      []string{`{"a":"{\"url\":\"https://h/x?sig=[CHAINLOOP_TRACE_REDACTED:r1]\"}"}`},
 		},
 		{
 			name:             "secret ending on a complete escaped backslash keeps it",
 			doc:              `{"a":"SEC\\ after"}`,
 			findings:         []Finding{{RuleID: "r1", Secret: `SEC\\`}},
 			wantReplacements: 1,
 			wantByRule:       map[string]int{"r1": 1},
-			mustContain:      []string{`{"a":"[REDACTED:r1] after"}`},
+			mustContain:      []string{`{"a":"[CHAINLOOP_TRACE_REDACTED:r1] after"}`},
 		},
 		{
 			name:     "protected path is left alone and recorded",
@@ -188,7 +188,7 @@ func TestRedact(t *testing.T) {
 			// The copy left in the protected leaf is still found on the next
 			// pass, where no eligible leaf holds it any more.
 			wantUnlocated: map[string]int{"r1": 1},
-			mustContain:   []string{`"keepme":"SEC"`, `"other":"x [REDACTED:r1]"`},
+			mustContain:   []string{`"keepme":"SEC"`, `"other":"x [CHAINLOOP_TRACE_REDACTED:r1]"`},
 		},
 		{
 			name:          "finding present nowhere is classified as an artifact",
@@ -368,7 +368,7 @@ func TestRedactOpaqueLeaves(t *testing.T) {
 		{
 			name: "secret in opaque data and in text",
 			doc:  `{"img":{"type":"base64","data":"aaSECaa"},"t":"y SEC y"}`,
-			want: `{"img":{"data":"aaSECaa","type":"base64"},"t":"y [REDACTED:r1] y"}`,
+			want: `{"img":{"data":"aaSECaa","type":"base64"},"t":"y [CHAINLOOP_TRACE_REDACTED:r1] y"}`,
 		},
 		{
 			name: "secret only in opaque data",
@@ -378,7 +378,7 @@ func TestRedactOpaqueLeaves(t *testing.T) {
 		{
 			name:        "data that is not opaque is still redacted",
 			doc:         `{"img":{"type":"url","data":"aaSECaa"}}`,
-			want:        `{"img":{"data":"aa[REDACTED:r1]aa","type":"url"}}`,
+			want:        `{"img":{"data":"aa[CHAINLOOP_TRACE_REDACTED:r1]aa","type":"url"}}`,
 			dataScanned: true,
 		},
 	}
@@ -455,9 +455,9 @@ func TestRedactText(t *testing.T) {
 		want        string
 		wantChanged bool
 	}{
-		{name: "a secret is replaced", text: "use " + secret + " now", want: "use [REDACTED:test-token] now", wantChanged: true},
+		{name: "a secret is replaced", text: "use " + secret + " now", want: "use [CHAINLOOP_TRACE_REDACTED:test-token] now", wantChanged: true},
 		{name: "text without secrets comes back unchanged", text: "nothing to see", want: "nothing to see"},
-		{name: "line breaks and quotes survive", text: "a \"quoted\"\nline " + secret, want: "a \"quoted\"\nline [REDACTED:test-token]", wantChanged: true},
+		{name: "line breaks and quotes survive", text: "a \"quoted\"\nline " + secret, want: "a \"quoted\"\nline [CHAINLOOP_TRACE_REDACTED:test-token]", wantChanged: true},
 	}
 
 	for _, tc := range testCases {

pkg/attestation/crafter/api/attestation/v1/crafting_state_test.go

@@ -504,8 +504,8 @@ func TestGetEvaluableContentRedactedNeverReadsDisk(t *testing.T) {
 		// Any distinguishable values work here; this test is about which source
 		// the content is read from, not about detection.
 		onDiskSecret = "the-unredacted-original"
-		inlineSecret = "[REDACTED:aws-access-token]"
-		suppliedTag  = "[REDACTED:supplied]"
+		inlineSecret = "[CHAINLOOP_TRACE_REDACTED:aws-access-token]"
+		suppliedTag  = "[CHAINLOOP_TRACE_REDACTED:supplied]"
 
 		onDisk   = `{"secret":"` + onDiskSecret + `"}`
 		inline   = `{"secret":"` + inlineSecret + `"}`
@@ -675,7 +675,7 @@ func TestGetEvaluableContentInjectsMetadata(t *testing.T) {
 		},
 	}
 
-	content, err := m.GetEvaluableContent("", []byte(`{"secret":"[REDACTED:jwt]"}`))
+	content, err := m.GetEvaluableContent("", []byte(`{"secret":"[CHAINLOOP_TRACE_REDACTED:jwt]"}`))
 	require.NoError(t, err)
 
 	var decoded struct {
@@ -686,7 +686,7 @@ func TestGetEvaluableContentInjectsMetadata(t *testing.T) {
 	}
 	require.NoError(t, json.Unmarshal(content, &decoded))
 
-	assert.Equal(t, "[REDACTED:jwt]", decoded.Secret)
+	assert.Equal(t, "[CHAINLOOP_TRACE_REDACTED:jwt]", decoded.Secret)
 	assert.Equal(t, AnnotationValueTrue, decoded.Metadata.Annotations[AnnotationMaterialRedacted])
 	assert.Equal(t, "2", decoded.Metadata.Annotations[AnnotationMaterialRedactionCount])
 	assert.Equal(t, "jwt", decoded.Metadata.Annotations[AnnotationMaterialRedactionRules])

pkg/attestation/crafter/materials/aicodingsession/redact_test.go

@@ -233,7 +233,7 @@ func TestRedact(t *testing.T) {
 
 			// Surrounding prose in a redacted leaf must be preserved.
 			assert.Contains(t, string(got), "deploy this, use AWS_ACCESS_KEY_ID=")
-			assert.Contains(t, string(got), "[REDACTED:aws-access-token]")
+			assert.Contains(t, string(got), "[CHAINLOOP_TRACE_REDACTED:aws-access-token]")
 			assert.Contains(t, string(got), "and a <config> block with \\\"quoted\\\" values. Done ✅")
 		})
 	}
@@ -405,7 +405,7 @@ func TestRedactSpecText(t *testing.T) {
 			// credential, and the text around it must survive.
 			name:           "a secret in a ticket body is replaced",
 			text:           "The runner is configured with the token " + fixtureGitHubPAT + " and still gets a 401.",
-			wantText:       "The runner is configured with the token [REDACTED:github-pat] and still gets a 401.",
+			wantText:       "The runner is configured with the token [CHAINLOOP_TRACE_REDACTED:github-pat] and still gets a 401.",
 			wantChanged:    true,
 			mustNotContain: fixtureGitHubPAT,
 		},

pkg/attestation/crafter/materials/chainloop_ai_coding_session_redaction_test.go

@@ -42,7 +42,7 @@ import (
 func TestUploadAndCraftContentOverride(t *testing.T) {
 	const (
 		onDisk   = `{"original":"content that is definitely longer"}`
-		redacted = `{"original":"[REDACTED]"}`
+		redacted = `{"original":"[CHAINLOOP_TRACE_REDACTED]"}`
 	)
 
 	testCases := []struct {
@@ -294,12 +294,12 @@ func TestChainloopAICodingSessionCrafterRedaction(t *testing.T) {
 				require.NotNil(t, content, "a redacted session must hand back its sanitized copy")
 				assert.Equal(t, sha256Digest(string(content)), got.GetArtifact().Digest)
 				assert.NotContains(t, string(content), awsKey)
-				assert.Contains(t, string(content), "[REDACTED:aws-access-token]")
+				assert.Contains(t, string(content), "[CHAINLOOP_TRACE_REDACTED:aws-access-token]")
 
 				if stored != nil {
 					assert.Equal(t, string(stored), string(content))
 					assert.NotContains(t, string(stored), awsKey)
-					assert.Contains(t, string(stored), "[REDACTED:aws-access-token]")
+					assert.Contains(t, string(stored), "[CHAINLOOP_TRACE_REDACTED:aws-access-token]")
 				}
 			case tc.skipRedaction:
 				assert.Equal(t, "true", got.Annotations[api.AnnotationMaterialRedactionSkipped])