[CI] Avoid logging test server environment values (#54379)
Signed-off-by: Taneem Ibrahim <taneem.ibrahim@gmail.com>
Taneem Ibrahim committed
Sep 3, 2026 at 16:00 UTC
e41011129bd54c9e8e12b645ea9b964027d2363f
2 files changed
+91
-4
tests/entrypoints/unit_tests/test_remote_vllm_server.py
+63
-1
@@ -6,7 +6,69 @@ from unittest.mock import Mock
6
import pytest
7
8
import tests.utils as test_utils
9
-from tests.utils import RemoteOpenAIServer
9
+from tests.utils import RemoteLaunchRenderServer, RemoteOpenAIServer
10
+
11
+
12
+@pytest.mark.parametrize(
13
+ ("args", "expected"),
14
+ [
15
+ (["--api-key", "key1", "key2"], ["--api-key", "***", "***"]),
16
+ (["--api_key", "key1", "key2"], ["--api_key", "***", "***"]),
17
+ (["--api-key=key1", "key2"], ["--api-key=***", "***"]),
18
+ (["--api_key=key1", "key2"], ["--api_key=***", "***"]),
19
+ (["--hf-token", "token"], ["--hf-token", "***"]),
20
+ (["--hf_token", "token"], ["--hf_token", "***"]),
21
+ (["--hf-token=token"], ["--hf-token=***"]),
22
+ (["--hf_token=token"], ["--hf_token=***"]),
23
+ ],
24
+)
25
+def test_redact_sensitive_cli_arg_variants(args: list[str], expected: list[str]):
26
+ assert test_utils._redact_sensitive_cli_args(args) == expected
27
+
28
+
29
+@pytest.mark.parametrize(
30
+ ("server_cls", "command"),
31
+ [
32
+ (RemoteOpenAIServer, ["vllm", "serve"]),
33
+ (RemoteLaunchRenderServer, ["vllm", "launch", "render"]),
34
+ ],
35
+)
36
+def test_server_redacts_sensitive_values(
37
+ server_cls,
38
+ command: list[str],
39
+ monkeypatch: pytest.MonkeyPatch,
40
+ capsys: pytest.CaptureFixture[str],
41
+):
42
+ server = object.__new__(server_cls)
43
+ popen = Mock()
44
+ monkeypatch.setattr(test_utils.subprocess, "Popen", popen)
45
+ monkeypatch.setenv("INHERITED_SECRET", "inherited-secret")
46
+ serve_args = [
47
+ "--api_key",
48
+ "api-secret-1",
49
+ "api-secret-2",
50
+ "--hf-token=hf-secret",
51
+ "--max-num-seqs",
52
+ "2",
53
+ ]
54
+
55
+ server._start_server(
56
+ "test-model", serve_args, {"OVERRIDE_SECRET": "override-secret"}
57
+ )
58
+
59
+ stdout = capsys.readouterr().out
60
+ assert "api-secret-1" not in stdout
61
+ assert "api-secret-2" not in stdout
62
+ assert "hf-secret" not in stdout
63
+ assert "inherited-secret" not in stdout
64
+ assert "override-secret" not in stdout
65
+ assert "--api_key *** ***" in stdout
66
+ assert "--hf-token=***" in stdout
67
+ assert "--max-num-seqs 2" in stdout
68
+ assert popen.call_args.args[0] == [*command, "test-model", *serve_args]
69
+ child_env = popen.call_args.kwargs["env"]
70
+ assert child_env["INHERITED_SECRET"] == "inherited-secret"
71
+ assert child_env["OVERRIDE_SECRET"] == "override-secret"
72
73
74
def test_openai_server_shutdown_wait_covers_engine_cleanup(
tests/utils.py
+28
-3
@@ -147,6 +147,28 @@ ROCM_ENGINE_KWARGS: dict = (
147
_TILELANG_TVM_PYTHONPATH_FRAGMENT = os.path.join(
148
"tilelang", "3rdparty", "tvm", "python"
149
)
150
+_SENSITIVE_CLI_ARG_NARGS = {"--api-key": "+", "--hf-token": "?"}
151
+
152
+
153
+def _redact_sensitive_cli_args(args: Sequence[str]) -> list[str]:
154
+ redacted_args = list(args)
155
+ index = 0
156
+ while index < len(args):
157
+ name, separator, _ = args[index].partition("=")
158
+ nargs = _SENSITIVE_CLI_ARG_NARGS.get(name.replace("_", "-"))
159
+ if nargs is None:
160
+ index += 1
161
+ continue
162
+ if separator:
163
+ redacted_args[index] = f"{name}=***"
164
+ index += 1
165
+ if not separator or nargs == "+":
166
+ while index < len(args) and not args[index].startswith("-"):
167
+ redacted_args[index] = "***"
168
+ index += 1
169
+ if nargs == "?":
170
+ break
171
+ return redacted_args
172
173
174
def _sanitize_pythonpath_value(pythonpath: str | None) -> str:
@@ -784,8 +806,8 @@ class RemoteOpenAIServer(RemoteVLLMServer):
806
env.update(env_dict)
807
_sanitize_pythonpath_env(env)
808
serve_cmd = ["vllm", "serve", model, *vllm_serve_args]
787
- print(f"Launching RemoteOpenAIServer with: {' '.join(serve_cmd)}")
788
- print(f"Environment variables: {env}")
809
+ redacted_serve_cmd = _redact_sensitive_cli_args(serve_cmd)
810
+ print(f"Launching RemoteOpenAIServer with: {' '.join(redacted_serve_cmd)}")
811
self.proc: subprocess.Popen = subprocess.Popen(
812
serve_cmd,
813
env=env,
@@ -812,7 +834,10 @@ class RemoteLaunchRenderServer(RemoteVLLMServer):
834
env.update(env_dict)
835
_sanitize_pythonpath_env(env)
836
serve_cmd = ["vllm", "launch", "render", model, *vllm_serve_args]
815
- print(f"Launching RemoteLaunchRenderServer with: {' '.join(serve_cmd)}")
837
+ redacted_serve_cmd = _redact_sensitive_cli_args(serve_cmd)
838
+ print(
839
+ f"Launching RemoteLaunchRenderServer with: {' '.join(redacted_serve_cmd)}"
840
+ )
841
self.proc: subprocess.Popen = subprocess.Popen(
842
serve_cmd,
843
env=env,