perf(test): normalize report secrets once per redaction

2026-10-04 15:00:24 +08:00
parent 055cd29e29
commit cbd5dc0ca2
2 changed files with 22 additions and 6 deletions
@@ -68,12 +68,17 @@ export function validateCoreEnvironment(env,root=repositoryRoot) {
  return base.origin
 }
 export function redactEvidence(value,secrets=[]) {
-  if(Array.isArray(value))return value.map(item=>redactEvidence(item,secrets))
-  if(value&&typeof value==='object')return Object.fromEntries(Object.entries(value).map(([key,item])=>[key,
-    /^(?:.*password|.*token|authorization|cookie|gateway|jenkinsUrl|privateKey)$/i.test(key)?'[REDACTED]':redactEvidence(item,secrets)]))
-  if(typeof value==='string')return secrets.filter(secret=>typeof secret==='string'&&secret.length>0)
-    .reduce((text,secret)=>text.split(secret).join('[REDACTED]'),value)
-  return value
+  // Long runs can register the same credential repeatedly. Normalize once per
+  // report, rather than filtering and reapplying it for every nested string.
+  const uniqueSecrets=[...new Set(secrets)].filter(secret=>typeof secret==='string'&&secret.length>0)
+  function redact(item) {
+    if(Array.isArray(item))return item.map(redact)
+    if(item&&typeof item==='object')return Object.fromEntries(Object.entries(item).map(([key,child])=>[key,
+      /^(?:.*password|.*token|authorization|cookie|gateway|jenkinsUrl|privateKey)$/i.test(key)?'[REDACTED]':redact(child)]))
+    if(typeof item==='string')return uniqueSecrets.reduce((text,secret)=>text.split(secret).join('[REDACTED]'),item)
+    return item
+  }
+  return redact(value)
 }
 export function modePassed(report) {
  const proof=report?.createdResources?.phase5RootFulfillment