Keep secrets out of argv and scope the explicit-creds skip to artifactapi

test/login_test.sh

@@ -8,11 +8,15 @@ REG=artifactapi.k8s.syd1.au.unkin.net
 OK_LOGIN='{"registry":"'$REG'","username":"woodpecker","password":"oidc-jwt"}'
 VAULT_FAIL=
 
+no_secret_argv() { case "$*" in *sa-jwt*|*s.client*|*oidc-jwt*) echo "secret in argv: $*" >&2; return 99 ;; esac; }
+jq() { no_secret_argv "$@" && command jq "$@"; }
+
 curl() {
   [ -z "$VAULT_FAIL" ] || return 22
+  no_secret_argv "$@" || return
   case "$*" in
     *auth/k8s/au/syd1/login*) grep -q '"role":"woodpecker_artifactapi_writer","jwt":"sa-jwt"' && echo '{"auth":{"client_token":"s.client"}}' ;;
-    *"X-Vault-Token: s.client"*identity/oidc/token/artifactapi-writer) echo '{"data":{"token":"oidc-jwt"}}' ;;
+    *"-H @-"*identity/oidc/token/artifactapi-writer) grep -qx 'X-Vault-Token: s.client' && echo '{"data":{"token":"oidc-jwt"}}' ;;
     *) return 22 ;;
   esac
 }
@@ -32,6 +36,7 @@ check "existing logins kept" '[{"registry":"r","username":"u","password":"p"},'"
 check "other registry skipped" "" PLUGIN_REPO=git.unkin.net/unkin/x
 check "dry run skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_DRY_RUN=true
 check "explicit creds skipped" "" PLUGIN_REGISTRY=$REG PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
+check "creds for another registry still log in" "[$OK_LOGIN]" PLUGIN_REGISTRY=git.unkin.net PLUGIN_REPO=$REG/docker-internal/x PLUGIN_USERNAME=u PLUGIN_PASSWORD=p
 check "explicit login skipped" '[{"registry":"'$REG'"}]' PLUGIN_REGISTRY=$REG 'PLUGIN_LOGINS=[{"registry":"'$REG'"}]'
 check "missing sa token is anonymous" "" PLUGIN_REGISTRY=$REG SA_TOKEN_FILE=/nonexistent
 check "vault failure is anonymous" "" PLUGIN_REGISTRY=$REG VAULT_FAIL=1

test/stub-entrypoint.sh

@@ -0,0 +1,2 @@
+#!/bin/sh
+IFS="|"; echo "$*"