distributhor/workflow-webhook

Add log level between `--verbose` and `--silent`

johannes-huther opened this issue · 0 comments

I'd like to have another log level between --verbose/ -v and --silent/ -s.

Currently, it is possible to pick between -v (default) and -s with the silent: [bool] parameter in the workflow config. Both of these options don't fit my needs:

  • --verbose/ -v logs a lot of information to the publically available workflow runs, that I do not want to be available including the domain of the webhook_url that I (as suggested in README.md) explicitly used a secret for. Also the resolved IP address is logged. This opens the door for DDoS attacks and makes hacking the machine one step easier.
  • --silent/ -s doesn't log anything (but I think this is obvious 😄), not even the response code.

Not specifying either -v or -s does log a minimal amount of output which would be enough for me to debug most issues, but little enough to not compromise on privacy.

Example output (on windows, but it should be similar on alpine): curl: (22) The requested URL returned error: 403 Forbidden. That's all.

I think the best way to address this issue is to add another option verbose: [bool] similar to silent: [bool].

Once again (as in #20), I do believe this new log level should be the default, but your opinion and that of other users might vary. Depending on your opinion the default value could be verbose: true or verbose: false.

Having the new log level as the default would also make fixing #22 way less critical.