.gitea/workflows/build.yaml

@@ -19,8 +19,8 @@ jobs:
           echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519.pub
           chmod 600 ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub
           ssh -o StrictHostKeyChecking=accept-new -T git@focs.gc.sjtu.edu.cn -p 2222
-        # - name: Lint
-        #   run: make lint
+      - name: Lint
+        run: make lint
       - name: Build
         run: make build
       - name: Version

cmd/joj3/conf/conf_test.go

@@ -1,8 +1,10 @@
 package conf
 
 import (
+	"bytes"
 	"crypto/sha256"
 	"encoding/hex"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -10,6 +12,26 @@ import (
 	"testing"
 )
 
+func TestConfLogValueRedactsSandboxToken(t *testing.T) {
+	var output bytes.Buffer
+	logger := slog.New(slog.NewJSONHandler(&output, nil))
+	conf := &Conf{
+		Name:         "test",
+		SandboxToken: "top-secret-token",
+	}
+	logger.Info("config", "conf", conf)
+	got := output.String()
+	if strings.Contains(got, "top-secret-token") {
+		t.Fatalf("configuration log exposed sandbox token: %s", got)
+	}
+	if !strings.Contains(got, "[REDACTED]") || !strings.Contains(got, `"Name":"test"`) {
+		t.Fatalf("configuration log lost expected diagnostic fields: %s", got)
+	}
+	if conf.SandboxToken != "top-secret-token" {
+		t.Fatalf("logging mutated the runtime configuration: %q", conf.SandboxToken)
+	}
+}
+
 func TestGetSHA256(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "input")
 	content := []byte("joj3")

cmd/joj3/conf/model.go

@@ -1,6 +1,8 @@
 package conf
 
 import (
+	"log/slog"
+
 	"github.com/joint-online-judge/JOJ3/internal/stage"
 )
 
@@ -32,6 +34,16 @@ type Conf struct {
 	PostStages        []ConfStage
 }
 
+// LogValue preserves the configuration's diagnostic value without writing the
+// sandbox credential to text or structured logs.
+func (c Conf) LogValue() slog.Value {
+	type logConf Conf
+	if c.SandboxToken != "" {
+		c.SandboxToken = "[REDACTED]"
+	}
+	return slog.AnyValue(logConf(c))
+}
+
 type OptionalCmd struct {
 	Args   *[]string
 	Env    *[]string