[secustor]

Changes

Two trace statements emitted registry credentials and relied on the secret sanitizer alone to mask them:

• pip-compile logged the whole extraEnv object, which holds the KEYRING_SERVICE_PASSWORD_n values built from host rules.
• helmv3 logged the generated helm registry login command, which carries --password <password>.

The sanitizer only registers secrets longer than three characters and only those that went through hostRules.add(), so both lines could leak a short or an externally sourced password.

pip-compile now logs the credential variable names alongside the command, and helmv3 logs the target host only. Specs assert that neither logger call receives the credential values.

Top of a stack of Python index credential clean-ups; each PR only contains its own layer and lands after the one below it.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Code, tests and this description were written with Claude Code (Claude Fable 5.1) under the author's direction and review.

Use of AI in replying to PR comments

Who answers review comments:

• @secustor will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

[github-actions]

🎉 This PR is included in version 44.101.1 🎉

The release is available on:

• GitHub release
• 44.101.1

Your semantic-release bot 📦🚀