Fix log with cli args

Signed-off-by: David Gageot <david.gageot@docker.com>

Author: dgageot

taskfile/run_test.go

@@ -2135,6 +2135,72 @@ func TestExpandVarsCallSiteVarBeatsCLIArgsParam(t *testing.T) {
 	assert.Equal(t, "op inject -f", expandVars("op inject {{.CLI_ARGS}}", vars, "--from-host"))
 }
 
+func TestExpandCLIArgsOnly(t *testing.T) {
+	// Only CLI_ARGS is expanded — every other variable is left as-is so logs
+	// don't accidentally leak secret values.
+	assert.Equal(t, "pytest -n 4 backend/tests",
+		expandCLIArgsOnly("pytest -n 4 {{.CLI_ARGS}}", nil, "backend/tests"))
+	assert.Equal(t, "pytest -n 4 backend/tests",
+		expandCLIArgsOnly("pytest -n 4 ${CLI_ARGS}", nil, "backend/tests"))
+	assert.Equal(t, "curl -H Authorization:${TOKEN} arg",
+		expandCLIArgsOnly("curl -H Authorization:${TOKEN} {{.CLI_ARGS}}", map[string]string{"TOKEN": "hunter2"}, "arg"))
+	// Call-site override beats the cliArgs param.
+	assert.Equal(t, "pytest -f",
+		expandCLIArgsOnly("pytest {{.CLI_ARGS}}", map[string]string{"CLI_ARGS": "-f"}, "--from-host"))
+}
+
+func TestRunnerLogExpandsCLIArgs(t *testing.T) {
+	dir := t.TempDir()
+	tf := &Config{
+		Dir: dir,
+		Tasks: map[string]Task{
+			"test": {
+				Cmds: []Cmd{{Cmd: "poetry run pytest -n 4 {{.CLI_ARGS}}"}},
+			},
+		},
+		DotenvVars: make(map[string]string),
+	}
+
+	runner := newTestRunner(t, tf, dir)
+	var stderr strings.Builder
+	runner.IO.Stderr = &stderr
+	captureExecs(runner)
+
+	require.NoError(t, runner.Run("test", "backend/tests/views/test_ask.py"))
+
+	// The log should show the CLI_ARGS expanded — not the raw `{{.CLI_ARGS}}` template.
+	log := stderr.String()
+	assert.Contains(t, log, "poetry run pytest -n 4 backend/tests/views/test_ask.py")
+	assert.NotContains(t, log, "{{.CLI_ARGS}}")
+}
+
+func TestRunnerLogDoesNotExpandOtherVars(t *testing.T) {
+	// Other ${VAR} / {{.VAR}} references stay un-expanded in the log so we
+	// don't accidentally surface secrets, while CLI_ARGS is shown.
+	dir := t.TempDir()
+	tf := &Config{
+		Dir: dir,
+		Tasks: map[string]Task{
+			"deploy": {
+				Env:  map[string]string{"TOKEN": "hunter2"},
+				Cmds: []Cmd{{Cmd: "deploy --token ${TOKEN} {{.CLI_ARGS}}"}},
+			},
+		},
+		DotenvVars: make(map[string]string),
+	}
+
+	runner := newTestRunner(t, tf, dir)
+	var stderr strings.Builder
+	runner.IO.Stderr = &stderr
+	captureExecs(runner)
+
+	require.NoError(t, runner.Run("deploy", "--dry-run"))
+
+	log := stderr.String()
+	assert.Contains(t, log, "deploy --token ${TOKEN} --dry-run")
+	assert.NotContains(t, log, "hunter2")
+}
+
 func TestRunnerLogsToInjectedStderr(t *testing.T) {
 	dir := t.TempDir()
 	tf := &Config{

taskfile/task_execution.go

@@ -156,8 +156,10 @@ func (r *Runner) runCmds(taskName string, cmds []Cmd, vars map[string]string, cl
 		}
 
 		if !silent {
-			// Log the original command template to avoid leaking expanded secrets.
-			r.logTask(colorGreen, taskName, cmd.Cmd)
+			// Log the original command template with CLI_ARGS substituted in,
+			// so the user sees what they actually passed without leaking other
+			// expanded variables (which may carry secrets).
+			r.logTask(colorGreen, taskName, expandCLIArgsOnly(cmd.Cmd, vars, cliArgs))
 		}
 
 		if r.DryRun {

taskfile/vars.go

@@ -120,3 +120,32 @@ func expandVars(s string, vars map[string]string, cliArgs string) string {
 		return match
 	})
 }
+
+// expandCLIArgsOnly substitutes only CLI_ARGS in a command string, leaving
+// every other ${VAR} and {{.VAR}} reference untouched. It is used to render
+// the per-cmd log line: CLI_ARGS comes from the user's invocation and is safe
+// to surface, while other variables may carry secrets sourced from env or
+// dotenv files and are deliberately not expanded in logs.
+//
+// CLI_ARGS resolution mirrors expandVars: a value in `vars` (typically a
+// call-site `vars: { CLI_ARGS: -f }`) wins over the cliArgs fallback.
+func expandCLIArgsOnly(s string, vars map[string]string, cliArgs string) string {
+	val := cliArgs
+	if v, ok := vars["CLI_ARGS"]; ok {
+		val = v
+	}
+
+	s = os.Expand(s, func(key string) string {
+		if key == "CLI_ARGS" {
+			return val
+		}
+		return "${" + key + "}"
+	})
+
+	return templatePattern.ReplaceAllStringFunc(s, func(match string) string {
+		if templatePattern.FindStringSubmatch(match)[1] == "CLI_ARGS" {
+			return val
+		}
+		return match
+	})
+}