Remove rendered manifest values from verbose logging (#649)

[leynos]

Summary

This branch removes the raw rendered-manifest JSON dump from --verbose
tracing output so secrets interpolated through env() can no longer leak
into terminal history, CI logs, or diagnostic bundles, closing the medium
severity Codex finding for issue #649.

Closes #649.

Review walkthrough

• Start with
  src/runner/graph_generation.rs
  to see the leak point removed: the tracing::enabled!(DEBUG) guard,
  serde_json::to_string_pretty(&manifest) serialisation, and the
  debug!("AST:...") event are replaced by a call to the new bounded
  structural telemetry entry point immediately after the manifest loads.
• Then review
  src/runner/manifest_structure_telemetry.rs
  for the replacement boundary. It records only fixed-vocabulary integer
  counts of the loaded manifest shape (variables, macros, rules, actions,
  targets, defaults) through a TRACE span and a metrics::counter! with a
  one-time describe_counter! registration. No manifest text, paths, recipe
  contents, variable values, or descriptions cross the telemetry boundary,
  because rendered values can carry secret material from env()
  interpolation.
• Finish with
  tests/logging_stderr/verbose_secret_absence.rs
  for the regression proof. The test drives the real --verbose generate
  CLI path with a distinctive sentinel injected through env('CI_SECRET')
  at the command, script, and variable rendering sites, and asserts the
  sentinel is absent from both stdout and stderr while the generated Ninja
  file still resolves the interpolation.

Validation

• make check-fmt: passes (Rust, Python, and Markdown formatting clean).
• make lint: passes (Clippy -D warnings, Whitaker Dylint suite, Pylint
  10.00/10, ambrleaks).
• make test: passes (cargo-nextest full workspace suite plus doctests,
  including the new secret-absence regression test).
• make doc-coverage: passes at 99.13%, above the 80% threshold.

Notes

• The retired runner.context.serialise_manifest Fluent key was removed
  from src/localization/keys.rs and all 35 locales/*/messages.ftl
  catalogues in one coordinated change so the localisation audit stays
  balanced without suppressing dead-code warnings.
• Generic keyword-based redaction is not used: after rendering, a secret
  may occur in an arbitrary string with no secret-bearing field name, so
  the fix removes the leak at the serialisation boundary instead.

Summary by Sourcery

Prevent rendered manifest contents from being emitted by verbose logging while retaining safe structural observability.

Bug Fixes:

• Prevent verbose tracing from exposing secrets contained in rendered manifests through environment interpolation.

Enhancements:

• Replace raw manifest dumps with bounded structural telemetry containing only aggregate manifest counts.
• Remove the obsolete manifest serialization localization key from all locale catalogues.

Tests:

• Add an end-to-end regression test confirming verbose generation omits rendered secrets while generated output still resolves them.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

The PR closes the verbose logging secret leak by eliminating rendered-manifest JSON serialization, emitting only bounded structural counts through telemetry, and adding an end-to-end test that verifies env()-resolved secrets remain in generated output but never appear in CLI logs; associated dead localization entries are removed.

Sequence diagram for secret-safe verbose manifest telemetry

sequenceDiagram
    participant CLI
    participant Runner
    participant Manifest as NetsukeManifest
    participant Telemetry
    participant Output as NinjaOutput

    CLI->>Runner: generate_ninja_with_shell()
    Runner->>Manifest: load_manifest_with_stage_reporting()
    Manifest-->>Runner: rendered manifest
    Runner->>Telemetry: record_manifest_structure(manifest)
    Telemetry->>Telemetry: describe_counter()
    Telemetry->>Telemetry: trace_span(variable_count, macro_count, rule_count, action_count, target_count, default_count)
    Telemetry->>Telemetry: counter().increment(1)
    Runner->>Output: generate Ninja graph
    Output-->>CLI: generated file contains resolved values
    Runner-->>CLI: verbose logs contain structural counts only

Loading

File-Level Changes

Change	Details	Files
Remove rendered manifest serialization from verbose tracing and replace it with bounded structural telemetry.	Delete the DEBUG-gated pretty-printed AST logging and its serialization error path. Record only fixed-vocabulary collection counts via a TRACE span and a once-described metrics counter. Invoke structural telemetry immediately after manifest loading.	src/runner/graph_generation.rs src/runner/manifest_structure_telemetry.rs src/runner/mod.rs
Add end-to-end regression coverage proving secret values are not exposed by verbose generation.	Inject one sentinel through env() at variable, command, and script rendering sites. Assert the sentinel is absent from stdout and stderr while remaining present in generated Ninja output. Register the test in the logging-stderr integration test suite.	tests/data/env_secret_sites.yml tests/logging_stderr/verbose_secret_absence.rs tests/logging_stderr_tests.rs
Remove the obsolete manifest-serialization localization key from all catalogs.	Delete the unused Fluent key declaration. Remove the corresponding translation entry from every locale catalog.	src/localization/keys.rs locales/*/messages.ftl

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#649	Remove serialization and logging of the fully rendered manifest from normal --verbose/TRACE output so rendered commands, scripts, variables, descriptions, paths, and other manifest values cannot leak through tracing.	✅
#649	Retain useful bounded structural diagnostics without emitting manifest text or rendered values.	✅
#649	Add a regression test covering env()-derived values in command, script, and variable sites through the real verbose CLI path, verifying absence from stdout and stderr while preserving rendering behavior.	✅

Possibly linked issues

• Remove rendered manifest values from verbose logging #649: PR directly implements issue Remove rendered manifest values from verbose logging #649 by removing raw AST logging, adding bounded diagnostics, and testing secret absence in verbose CLI output.
• Remove rendered manifest values from verbose logging #649: PR removes graph-generation AST JSON serialization and adds bounded structural telemetry, directly satisfying the issue.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codescene-access]

No quality gates enabled for this code.