The `no_log: true` on the include in tasks/main.yaml only censors the include statement and its loop item. It is not
inherited by the included tasks, which was verified with a minimal playbook: a debug task inside an included file prints
its message in clear even though the include itself is censored.
Two tasks therefore leaked secrets. The netrc template exposes every machine password in its rendered content, and the
copy of the private ssh keys exposes the key material itself. Both are printed by the diff mode, which is exactly the
mode used when reviewing what a run would change. They are marked `no_log` individually now.
The user task is deliberately left alone. Its `password` argument is declared `no_log` in the argument spec of the
module, so ansible already censors it, and a task level flag would only make the remaining output useless.
The blanket flag on the include stays in place, because the loop item still carries the plaintext password.
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot
f222b1c615