potiuk opened a new pull request, #67503: URL: https://github.com/apache/airflow/pull/67503
`mask_secret()` mirrors the mask to the supervisor process so any forwarded logs are masked there too. The send at [`log.py:281`](https://github.com/apache/airflow/blob/main/task-sdk/src/airflow/sdk/log.py#L281) was wrapped in a bare `suppress(Exception)`, so a transient IPC failure was silently swallowed. When `sending_to_supervisor=True` the local task drops its own `mask_logs` processor (it relies on the supervisor to do the masking — see `log.py` lines 72-73 and 115-118) — so a silent send failure could leave the secret unmasked in supervisor-level logs. Operators had no signal that this had happened. Reported as F-001 in the [`apache/tooling-agents` L3 task-sdk sweep `0920c77`](https://github.com/apache/tooling-agents/issues/24). ## Change Replace the bare `suppress` with a targeted `try/except` that emits a warning to a dedicated `airflow.logging.mask_secret` structlog logger when the supervisor *is* available but the send fails. The "no supervisor context" case (`mask_secret` called outside task execution, no `SUPERVISOR_COMMS`) stays silent — there is no supervisor to notify. ## Test plan - [x] `test_warns_when_supervisor_send_fails` — patches `task_runner.SUPERVISOR_COMMS` to a Mock whose `send` raises; captures structlog output and asserts the `supervisor_mask_secret_failed` event lands with the secret name and exc_info. - [x] `test_silent_when_supervisor_send_succeeds` — success path emits no warning, `comms.send` called once. - [x] `test_silent_when_no_supervisor_context` — outside a task-execution context the function is a no-op. - [x] `prek run ruff` clean. - [x] `prek run mypy-task-sdk` clean. - [x] Full `test_log.py` suite: 8 passed. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.7) Generated-by: Claude Code (Opus 4.7) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
