[Workflows] Add sensitive option to Workflows steps

[pombosilva]

Fixes WOR-1485.

Adds sensitive: output to step outputs, matching prod behavior.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: it's already documented

A picture of a cute animal (not mandatory, but encouraged)

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 1acfba1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
wrangler	Minor
miniflare	Minor
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/pages-shared	Patch
@cloudflare/runtime-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/workflows
• ✅ @cloudflare/wrangler

Show detailed file reviewers

[ask-bonk]

UnknownError: ProviderInitError

github run

[ask-bonk]

@pombosilva Bonk workflow failed. Check the logs for details.

View workflow run · To retry, trigger Bonk again.

[github-actions]

✅ All changesets look good

[ask-bonk]

UnknownError: ProviderInitError

github run

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@14742

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@14742

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14742

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14742

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14742

miniflare

npm i https://pkg.pr.new/miniflare@14742

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14742

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14742

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14742

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@14742

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@14742

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14742

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14742

wrangler

npm i https://pkg.pr.new/wrangler@14742

commit: 1acfba1

[pombosilva]

/bonk

[ask-bonk]

Review — [Workflows] Add sensitive option to Workflows steps

Reviewed the redaction logic, validator changes, and tests. The implementation is correct and well-scoped. 👍

What works well

• Redaction happens at the right seam. Applying redaction only when writing events.success (context.ts:1263-1276) means every downstream consumer — readLogs, waitForStepResult (engine.ts:710-714, 746-748), and the binding output (binding.ts:434) — reads the already-redacted value from the same persisted log metadata. No consumer sees the raw value.
• The real value still flows downstream. persistStepResult stores/returns the unmodified result, so redactOutput only affects the log payload. The test should redact ... while passing the real value downstream covers this precisely.
• Errors are never redacted. Redaction is confined to the success path, so ATTEMPT_FAILURE/STEP_FAILURE error messages are untouched — verified by the should not redact a sensitive step's error test.
• Streams handled. When redactOutput is set, streamOutput meta is omitted (context.ts:1271-1274) and result becomes [REDACTED], so a sensitive stream can't be replayed via waitForStepResult. Good.
• sensitive propagates via config. toEngineStepConfig spreads ...config, so ctx.config.sensitive is exposed to callbacks, matching prod.
• Validator is appropriately strict — z.literal("output") rejects sensitive: "all" / sensitive: true, both covered in validators.test.ts.

Minor observations (non-blocking)

1. Changeset targeting — @cloudflare/workflows-shared is private, so targeting wrangler/miniflare (minor) in the changeset is the correct user-facing choice. Just confirming this is intentional and not an oversight.
2. REDACTED_STEP_OUTPUT export surface — it's exported from src/context.ts purely for the test. That's fine, but if you'd prefer to keep it internal you could colocate the constant in a test helper instead. Not important.

Suggestion (optional)

Consider a test asserting ctx.config.sensitive === "output" is observable inside the step callback, since that's now part of the public-facing EngineStepConfig shape and prod parity. Currently only the redaction side-effect is tested.

Overall LGTM.

[ask-bonk]

Review posted successfully to PR #14742.

Summary

I reviewed PR #14742 ([Workflows] Add sensitive option to Workflows steps) and posted a review comment. The implementation is correct and well-scoped:

Key findings (all positive):

• Redaction is applied at a single seam — writing the STEP_SUCCESS log (context.ts:1263) — so all consumers (readLogs, waitForStepResult, binding output) read the already-redacted value from the same persisted metadata. No path leaks the raw value.
• The real (unredacted) value still flows to downstream steps, since persistStepResult returns the untouched result.
• Errors are never redacted (redaction is confined to the success path).
• Streams are handled: streamOutput meta is omitted and result becomes [REDACTED].
• Validator is correctly strict (z.literal("output") rejects "all"/true).
• Changeset correctly targets wrangler/miniflare since @cloudflare/workflows-shared is private.

Minor, non-blocking notes:

• Confirmed the changeset targeting is intentional.
• REDACTED_STEP_OUTPUT is exported solely for tests (fine).
• Optional suggestion: add a test asserting ctx.config.sensitive is observable inside the step callback, since it's now part of the public EngineStepConfig shape.

Overall LGTM.

github run

[workers-devprod]

Codeowners reviews satisfied