fix: pass Ansible secret extra vars as JSON

[Iceman-ZP]

What does this PR do?

Fixes Ansible Variable Group secret variables being passed as separate --extra-vars name=value arguments.

Secret variables of type var are now merged into the existing JSON extra-vars payload before it is serialized and passed to Ansible.

This preserves values containing spaces and other complex content.

Environment secrets of type env are unchanged and continue to be passed as environment variables.

Why?

Regular extra variables are already passed to Ansible as JSON, but Variable Group secret variables were appended separately using:

--extra-vars name=value

This can cause Ansible to parse values containing spaces incorrectly.

Fixes #4249.

Behavior

The change preserves:

• secret variable precedence over regular extra variables;
• EnvironmentSecretEnv behavior;
• a single JSON --extra-vars payload.

Tests

Added a regression test covering:

• secret values containing spaces;
• multiline secret values;
• secret variable override precedence;
• exclusion of EnvironmentSecretEnv values;
• use of a single JSON extra-vars payload.

Tested with:

go test ./services/tasks -run TestGetPlaybookArgs_EnvironmentSecretVarsUseJSON -count=1

and:

go test ./services/tasks -count=1

Both pass on the current develop branch.

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of database secret variables during task execution.
  • Secret values, including those containing spaces or multiple lines, are now passed reliably as part of the consolidated variable payload.
  • Secret variables correctly take precedence over plain variables with the same name.
  • Secrets intended for environment-level configuration are excluded from task variables.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 62bdf00c-7880-4b9f-ada5-cf549bfc08dd

📥 Commits

Reviewing files that changed from the base of the PR and between 83bddaf and 94a5556.

📒 Files selected for processing (2)

• services/tasks/local_executor.go
• services/tasks/local_executor_test.go

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Environment variable secrets are merged into the JSON --extra-vars payload. Separate name=value arguments are removed. Tests verify complex values, secret precedence, and exclusion of environment-target secrets.

Changes

Environment secret transport

Layer / File(s)	Summary
Consolidated JSON extra-vars flow services/tasks/local_executor.go, services/tasks/local_executor_test.go	Variable-type environment secrets are added to the JSON extra-vars map. Separate secret arguments are removed. Tests verify spaces, multiline values, precedence, and env-target exclusion.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: fiftin

Merge Risk: ⚪ Minimal · up to 94a55

Secret variable values are now transported through the consolidated JSON payload while environment-only secrets remain excluded. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: passing Ansible secret extra variables through the JSON payload.
Linked Issues check	✅ Passed	Issue #4249 requires EnvironmentSecretVar values to use the JSON --extra-vars payload, retain secret precedence, keep EnvironmentSecretEnv values out of that payload, and remove separate `name=v…
Out of Scope Changes check	✅ Passed	The changes are limited to Ansible extra-variable construction in services/tasks/local_executor.go and its regression test in services/tasks/local_executor_test.go. The implementation and test dir…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[fiftin]

@Iceman-ZP as I remember the env is stored in a database in the task table.

Secrets shouldn't be stored in the database.

[Iceman-ZP]

Thanks for pointing this out. Just to clarify, my intention here wasn't to change how Semaphore stores secrets. I ran into this while using a multiline private key as an Ansible secret variable. With the current --extra-vars name=value form, part of the value was lost during parsing. Passing the same value as JSON fixed the issue in my setup, so I opened this PR mainly to share the problem and the working fix I used. If this approach conflicts with how secrets are expected to be handled internally, I'm happy to leave the implementation decision to the maintainers. вс, 20 сент. 2026 г. в 09:46, Denis Gukov ***@***.***>:

…

*fiftin* left a comment (semaphoreui/semaphore#4250) <#4250 (comment)> @Iceman-ZP <https://github.com/Iceman-ZP> as I remember the env is stored in a database in the task table. Secrets shouldn't be stored in the database. — Reply to this email directly, view it on GitHub <#4250?email_source=notifications&email_token=CLMNPFN4XC4KGRV3DQXXOA35P54MNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZUHAZDANZZGQ3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5748207946>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CLMNPFMUJCIHK6ILLV3FQLD5P54MNAVCNFSNUABEKJSXA33TNF2G64TZHMZDGMRWG44DQMZ3JFZXG5LFHM2TIOJWHAYTGNZRGOQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CLMNPFPGJEAOYJTXRZLFFA35P54MNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZUHAZDANZZGQ3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/CLMNPFLJ6US3GFLZ2BLO7RD5P54MNA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKNZUHAZDANZZGQ3KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>