Provide a hook or feature to sanitize some displayed content

What's the problem this feature will solve?

I'm writing some fixtures and integration tests using live, authenticated connections to a test instance of a service. My test infrastructure can take care not to commit authentication secrets to the repository by putting them in a configuration file outside the repo. However, some of the tests or fixtures take this connection information (say, in a dict with keys like username and password) as an argument. If there is an error in a fixture or a failure of a test, pytest will print the value of these arguments. For local testing, this isn't too bad, since these credential secrets just get printed to my console. But if I run the test suite in my CI, then this output can leak credential information into pipeline logs, posing a security risk.

I'd like a way to be able to sanitize such output so username/password (or other secrets) don't get printed.

Describe the solution you'd like

I'm not sure what a solution would look like. I did try to search both pytest's documentation and pytest plugins on PyPI, plus some general internet searches (and maybe even a ChatGPT query or two) to try to find an existing solution. None of them worked or were simple to set up.

Off the top of my head I'm thinking something like a pytest decorator that I could place on some fixture functions and/or test methods that would signal that the arguments -- or possibly even local variables -- have sensitive information. This decorator could specify a user-supplied sanitation function that would get called on error or failure. This sanitation function would get some mutable structure of all the variables that pytest would normally print to the console, and this function would have the opportunity to change the values before they get printed. (Of course, pytest would have to be careful not to print this structure if the sanitation function itself has a bug!).

So in my situation, it might get access that credentials dictionary as an argument or local variable. My sanitation function could then look for username and password keys, and replace the value with '**suppressed**' or some such. Then pytest would print that sanitized variable without leaking the credentials.

Alternative Solutions

I've tried to write a custom plugin but have not had any luck in doing this. Part of the problem I think is that there is no public, supported API for getting access to the list of variables that will be printed, and no good way of interposing just before these variables are printed.

Additional context

I'm rather surprised this hasn't come up before, but if it has and I have missed the solution, then TIA for any guidance you can provide!

Start by examining pytest's fixture and test failure reporting, especially the public plugin API and how arguments or local variables are selected for output. Determine a supported interception point and define how a user-supplied sanitizer would safely transform sensitive values. Done means credentials and other marked secrets are suppressed in failure output without exposing sanitizer errors.