From 8779dc581830e271aa50c959c0a810492ee791ed Mon Sep 17 00:00:00 2001
From: Clint Branham <goodolclint@gmail.com>
Date: Wed, 18 Mar 2026 16:46:55 -0500
Subject: [PATCH] fix(ci): correct nested PVE node name and mask secrets in
 logs

- Change FQDN from pve-test.local to pve.test.local so the PVE node
  name is "pve" (matching what tests expect)
- Mask the dynamically created API token and VM IP with ::add-mask::
  before they appear in workflow logs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/integration-tests.yml | 5 ++++-
 tests/infrastructure/answer.toml.tftpl  | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index a0f15cf..7f1e3a8 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -130,9 +130,12 @@ jobs:
             "${{ steps.terraform.outputs.vm_id }}" \
             "${PVE_PASSWORD}" \
             900)
-          echo "$OUTPUT"
           VM_IP=$(echo "$OUTPUT" | grep "^IP=" | cut -d= -f2)
           VM_TOKEN=$(echo "$OUTPUT" | grep "^TOKEN=" | cut -d= -f2-)
+          # Mask sensitive values before they appear in logs
+          echo "::add-mask::${VM_IP}"
+          echo "::add-mask::${VM_TOKEN}"
+          echo "Nested PVE ready at ${VM_IP}"
           echo "host=${VM_IP}" >> "$GITHUB_OUTPUT"
           echo "token=${VM_TOKEN}" >> "$GITHUB_OUTPUT"
 
diff --git a/tests/infrastructure/answer.toml.tftpl b/tests/infrastructure/answer.toml.tftpl
index 6521e99..c7fea2b 100644
--- a/tests/infrastructure/answer.toml.tftpl
+++ b/tests/infrastructure/answer.toml.tftpl
@@ -1,7 +1,7 @@
 [global]
 keyboard = "en-us"
 country = "us"
-fqdn = "pve-test.local"
+fqdn = "pve.test.local"
 mailto = "test@test.local"
 timezone = "UTC"
 root_password = "${root_password}"