From 031fd365efa196216a3dd8ed6698101e22445e19 Mon Sep 17 00:00:00 2001 From: Stavros Kroustouris Date: Fri, 21 Aug 2026 12:24:39 +0300 Subject: T2295: vyos_user: set explicit no_log on update_password (#479) * vyos_user: set no_log=False on update_password parameter Prevents Ansible from redacting update_password in module args when configured_password is present with no_log=True. Co-authored-by: Cursor * T2295: document why update_password needs explicit no_log=False Ansible PASSWORD_MATCH hides parameters named *password* when no_log is unset (not the same as defaulting to False). Add comment, changelog wording, and a unit test; align with ansible.core user module. Co-authored-by: Cursor * T2295: add comment for update_password no_log=False Co-authored-by: Cursor * T2295: drop source-inspection test for update_password no_log Remove test_vyos_user_update_password_explicit_no_log_false; existing execute_module tests already cover update_password behavior. Co-authored-by: Cursor * T2295: fix CI failures (changelog line length, devel/py3.12 matrix) Shorten the changelog fragment to satisfy ansible-lint line-length (160). Skip py3.12-devel tox environments and exclude devel+Python 3.12 from unit-source now that ansible-core devel requires Python >=3.13. Co-authored-by: Cursor * Add docstrings to vyos_user functions and workflow permissions Adds docstrings to all undocumented module-level functions in vyos_user.py to bring docstring coverage above the 80% threshold. Adds explicit `permissions: contents: read` to codecoverage.yml as recommended by CodeRabbit for least-privilege CI security. Co-Authored-By: Claude Sonnet 4.6 * Revert "Add docstrings to vyos_user functions and workflow permissions" This reverts commit 616b27bc339a7607eae15e91a605c70dae15248b. * T2295: drop unrelated CI/tox changes; reword changelog Revert the matrix_exclude block in tests.yml and the py3.12-devel skip in tox-ansible.ini; those were CI workarounds unrelated to this fix and are no longer needed against current main. Reword the changelog fragment to describe the observable behavior instead of the internal PASSWORD_MATCH constant. --------- Co-authored-by: Cursor Co-authored-by: omnom62 <75066712+omnom62@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 --- plugins/modules/vyos_user.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'plugins/modules') diff --git a/plugins/modules/vyos_user.py b/plugins/modules/vyos_user.py index 0c79ce30..37b2a3b2 100644 --- a/plugins/modules/vyos_user.py +++ b/plugins/modules/vyos_user.py @@ -456,7 +456,8 @@ def main(): full_name=dict(), configured_password=dict(no_log=True), encrypted_password=dict(no_log=False), - update_password=dict(default="always", choices=["on_create", "always"]), + # Explicit no_log=False: unset no_log triggers Ansible PASSWORD_MATCH on *password* names. + update_password=dict(default="always", choices=["on_create", "always"], no_log=False), state=dict(default="present", choices=["present", "absent"]), public_keys=dict(type="list", elements="dict", options=public_key_spec), ) -- cgit v1.2.3