fix: exclude JWT token from workload repr to prevent log exposure

[SibtainOcn]

What

Prevents JWT tokens from leaking into task logs by setting repr=False on the token field in BaseWorkloadSchema.

Closes: #62428
Closes: #62773

Why

When workload objects are logged (e.g. log.info('Executing workload', workload=workload) in execute_workload.py), Pydantic's auto-generated __repr__ includes all fields — including the raw JWT token. This is a security concern since tokens grant API access and should never appear in log output.

The log output currently looks like:

ExecuteTask(token='eyJhbGciOi...full_token_here', ti=TaskInstance(...), ...)

How

Uses Pydantic's built-in Field(repr=False) on the token field in BaseWorkloadSchema (the base class for all workload DTOs). This:

1. Excludes the token from repr()/str() output — so it never appears in logs
2. Preserves full access via workload.token — no functional change
3. Fixes all executors at the model level — KubernetesExecutor, CeleryExecutor, ECS, etc.

After the fix, log output shows:

ExecuteTask(ti=TaskInstance(...), dag_rel_path=..., type='ExecuteTask')

Comparison with #62782

PR #62782 takes a different approach: it modifies the logging call sites to log individual fields and adds a structlog regex redactor. Our approach fixes the root cause at the model level (1 line change vs 4 files), ensuring the token is hidden from repr regardless of where or how the workload object is logged.

Both approaches are valid and complementary — Field(repr=False) prevents the leak at the source, while a structlog redactor provides defense-in-depth.

Changes

• airflow-core/src/airflow/executors/workloads/base.py: Add Field import; set repr=False on token field
• airflow-core/tests/unit/executors/test_workloads.py: Add regression test verifying token is excluded from repr
• airflow-core/newsfragments/62428.bugfix.rst: Changelog entry

Testing

• Added unit test test_token_excluded_from_workload_repr that creates an ExecuteTask with a fake JWT and asserts repr() does not contain it
• Verified locally with Pydantic 2.12.5

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[Copilot]

Pull request overview

This PR fixes a security issue where JWT tokens were being exposed in task logs via Pydantic's auto-generated __repr__ output. When workload objects are logged (e.g., log.info("Executing workload", workload=workload)), the full JWT token was visible in structured log output. The fix uses Pydantic's Field(repr=False) on the token field in BaseWorkloadSchema, the base class for all workload DTOs.

Changes:

• Set repr=False on the token field in BaseWorkloadSchema to prevent JWT tokens from appearing in repr/str output
• Added a regression test to verify the token is excluded from repr() while remaining accessible as an attribute
• Added a changelog newsfragment for the bugfix

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
airflow-core/src/airflow/executors/workloads/base.py	Added Field import and set repr=False on the token field in BaseWorkloadSchema
airflow-core/tests/unit/executors/test_workloads.py	Added regression test test_token_excluded_from_workload_repr verifying token exclusion from repr
airflow-core/newsfragments/62428.bugfix.rst	Changelog entry for the bugfix

---

You can also share your feedback on Copilot code review. Take the survey.

stale

[SibtainOcn]

Hey, all the review comments have been addressed and pushed. Just waiting on CI workflow approval whenever someone gets a chance.

[SibtainOcn]

I done fix for the trailing blank line that keeps failing the static checks. Verified locally with pre-commit and trailing-whitespace, end-of-file checks pass now. Hope this goes through, if it still fails, could use some help understanding what the hook expects ?

[boring-cyborg]

Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions.

[github-actions]

Backport failed to create: v3-1-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	v3-1-test

You can attempt to backport this manually by running:

cherry_picker b196cf3 v3-1-test

This should apply the commit to the v3-1-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.