Script key is logged in plaintext in fetch URL

[ehs5]

FetchService.get_superoffice_data logs the full script URL before the request, and build_script_url puts the tenant's secret key in the query string, so every fetch writes the key in plaintext to the log, and into the invalid-JSON error message.

Mask the access key so it is not visible at all.

[devin-ai-integration]

No CI checks are configured on the repo, so nothing to wait for — #15 is ready for review.

[devin-ai-integration]

Live SOD fetch passed: 924 files across all six categories, endpoint log shows key=***, zero occurrences of the key in CLI output. PR body updated: #15

[devin-ai-integration]

They're in the scratch dir /tmp/cf-out on my VM only — nothing committed, and /tmp is wiped when the machine resets. Want me to delete them now?

[devin-ai-integration]

Deleted /tmp/cf-out and the scratch settings file.

[devin-ai-integration]

Inlined it into mask_key and pushed; tests still green. #15

[devin-ai-integration]

Yes — issue #14 implemented, tests green, live SOD fetch verified, scratch files cleaned up. #15 is ready to merge.

[devin-ai-integration]

Yes — python -m pytest tests -q: 87 passed, both after the initial change and again after the last commit.

[devin-ai-integration]

No — the repo's only workflow is release.yml (tagged releases); there's no CI workflow running pytest on PRs, so the Checks tab stays empty. I ran the suite locally. Want me to add a PR workflow that runs pytest on push/PR?

[devin-ai-integration]

on: pull_request fires when a PR is opened, when new commits are pushed to its branch (each push re-runs the checks), and when it's reopened or retargeted — not on merge. So you'd see a green/red check per push while the PR is open. Usually you pair it with on: push: branches: [master] so master itself is also tested after merge.

[devin-ai-integration]

Yes, that's the standard setup: on: pull_request (feedback before merge) plus on: push to the default branch (catches anything that lands another way). Common additions: a concurrency block to cancel superseded runs on the same PR, and a matrix if you want multiple Python versions. Say the word and I'll open a PR with it.

[devin-ai-integration]

Separate — it's unrelated to #14, and keeping it out means the security fix isn't held up by CI config churn. I'd do a standalone PR (no issue needed unless you want the paper trail). Want me to open it now?

[devin-ai-integration]

Not testing — release.yml builds the app on macOS and Windows runners on version tags, but it never runs pytest; nothing has ever run the suite in CI. My new workflow runs it on ubuntu only. Want me to matrix it over ubuntu/windows/macos instead?