[Renerick]

HiddenValue is already allowed to be passed as-is to environment variables (#1853). I think it's sensible to be able to pass it to templates as well

Current workaround is to call .unmask() in the template body, which leaks knowledge of secrets and pyinfra api. Existing templates with .unmask() calls will not be broken by this change

• Pull request is based on the default branch (3.x at this time)
• Pull request includes tests for any new/updated operations/facts
• Pull request includes documentation for any new/updated operations/facts
• Tests pass (see scripts/dev-test.sh)
• Type checking & code style passes (see scripts/dev-lint.sh)
• Pull request title follows the
  conventional commits format

---

AI disclosure

Codex has been used for code review and test generation, implementation changes were done by hand

[wowi42]

Superseded by the formal review below.

[wowi42]

Thanks for adding this. Being able to use HiddenValue naturally in templates is useful, and the rendered value reaches the upload correctly.

I spotted two things that I think we should fix before merging.

First, with DIFF enabled, the unmasked content reaches files.put, which logs the desired lines through generate_color_diff. That can print plaintext secrets with pyinfra --diff. Could we suppress or redact those diffs when hidden inputs are present, and add coverage showing that the secret is uploaded but absent from the logs?

Second, this truthiness check can skip a valid callable finalizer whose __bool__ returns False:

if user_finalize:
    v = user_finalize(v)

Using if user_finalize is not None: would preserve the previous callable API behavior.

Thanks again for contributing this.