Skip to content

docs(run-workflow): explain that {{KEY}} in run output is a redaction #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mzxchandra merged 3 commits into from
Sep 15, 2026
Merged

docs(run-workflow): explain that {{KEY}} in run output is a redaction #11

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0c3340e
docs(run-workflow): explain that {{KEY}} in run output is a redaction
mzxchandra Sep 15, 2026
ec20e16
Merge origin/main into docs/run-workflow-secret-masking
mzxchandra Sep 15, 2026
c8754f8
docs(run-workflow): correct three wrong claims in the masking section
mzxchandra Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions skills/run-workflow/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,21 @@ Four properties of runs and run records that mislead diagnosis when unknown:
in-workflow logs block reports the same run's cost in credits. Never compare or store the two as
one number.

## `{{KEY}}` in run output is usually a mask, not a failure

Only `workflows runs get` and `logs get` return the masked copy, where a resolved secret is written
back as `{{KEY}}` - or `[REDACTED_SECRET]` when it cannot be pinned to one name. Live run output is
never masked: a plain run and a `--follow` stream hit the same endpoint and both carry real values,
so never quote either back.

So a `{{KEY}}` in a masked log is usually a resolved secret rather than a broken reference - but it
is not proof. An unresolved name survives too: JavaScript and Python leave it literal, shell
resolves it to the empty string, and a secret shorter than 8 characters is never masked at all, so
its `{{KEY}}` is always unresolved. `sim --output json secrets list` proves only that a name exists,
not that it resolved in this run. When a block behaves as though the credential were literal text,
check the spelling there first - but never "fix" a working reference by rewriting it into
`environmentVariables.KEY` or hardcoding a literal.

Report which mode ran, the terminal status, and the relevant output or error. Include the run id when
the selected execution mode returns one; `--follow` streams omit it. Never print profile credentials
or raw secrets from block inputs.
Loading