Make masking (secrets) optional

[kzhuklinets]

Hi,

We are trying to migrate to dependabot@2 and as we use a self-hosted Azure DevOps, we are struggling with issues described in here #1550, and the masking prevents from being sure regarding a root cause. If possible, could URLs be optional to be marked as secrets?

dependabot-azure-devops/extension/tasks/dependabotV2/index.ts

Line 38 in 873d430

setSecrets(

[rhyskoedijk]

@mburumaxwell any thoughts on this? I could wrap the setSecret in a if (tl.getVariable('System.Secrets')?.match(/true/i)) to disable this if the user really wants to, but that is another toggle.

[mburumaxwell]

It makes sense though I do not know if there is an official reference to System.Secrets or it would be our own definition.

[rhyskoedijk]

I made it up, just as an example

[mburumaxwell]

We can work with it. A boolean input would be okay.

[mburumaxwell]

Added in #1597, released in 1.44.0, and published in 1.44.0.1200.

Example:

trigger: none # Disable CI trigger

pool:
  vmImage: 'ubuntu-latest' # requires macos or ubuntu (windows is not supported)

variables:
  system.debug: 'true'

jobs:
- job: unprotected
  variables:
    System.Secrets: false

  steps:
  - task: dependabot@2
    inputs:
      skipPullRequests: true

- job: protected
  variables:
    System.Secrets: true

  steps:
  - task: dependabot@2
    inputs:
      skipPullRequests: true

Please test and get back.