Redact credentials when displaying URLs (#13333)

This PR redacts credentials in displayed URLs. 

It mostly relies on a `redacted_url` function (and where possible
`IndexUrl::redacted`). This is a quick way to prevent leaked credentials
but it's prone to programmer error when adding new trace statements. A
better follow-on would use a `RedactedUrl` type with the appropriate
`Display` implementation. This would allow us to still extract
credentials from the URL while displaying it securely. On the plus side,
the sites where the `redacted_url` function are used serve as easy
signposts for where to use the new type in a future PR.

Closes #1714.

crates/uv-git/Cargo.toml

@@ -20,6 +20,7 @@ uv-auth = { workspace = true }
 uv-cache-key = { workspace = true }
 uv-fs = { workspace = true, features = ["tokio"] }
 uv-git-types = { workspace = true }
+uv-redacted = { workspace = true }
 uv-static = { workspace = true }
 uv-version = { workspace = true }
 

crates/uv-git/src/credentials.rs

@@ -4,6 +4,7 @@ use tracing::trace;
 use url::Url;
 use uv_auth::Credentials;
 use uv_cache_key::RepositoryUrl;
+use uv_redacted::redacted_url;
 
 /// Global authentication cache for a uv invocation.
 ///
@@ -31,7 +32,7 @@ impl GitStore {
 /// Returns `true` if the store was updated.
 pub fn store_credentials_from_url(url: &Url) -> bool {
     if let Some(credentials) = Credentials::from_url(url) {
-        trace!("Caching credentials for {url}");
+        trace!("Caching credentials for {}", redacted_url(url));
         GIT_STORE.insert(RepositoryUrl::new(url), credentials);
         true
     } else {

crates/uv-git/src/source.rs

@@ -13,6 +13,7 @@ use url::Url;
 
 use uv_cache_key::{cache_digest, RepositoryUrl};
 use uv_git_types::GitUrl;
+use uv_redacted::redacted_url;
 
 use crate::git::GitRemote;
 use crate::GIT_STORE;
@@ -100,7 +101,10 @@ impl GitSource {
             // situation that we have a locked revision but the database
             // doesn't have it.
             (locked_rev, db) => {
-                debug!("Updating Git source `{}`", self.git.repository());
+                debug!(
+                    "Updating Git source `{}`",
+                    redacted_url(self.git.repository())
+                );
 
                 // Report the checkout operation to the reporter.
                 let task = self.reporter.as_ref().map(|reporter| {