Withhold secret-looking variables from the processes the runner starts

Workers and the other processes the runner starts copied its whole
environment, tokens and passwords included. ChildProcess::Start now
leaves out every variable whose name contains, in any case, TOKEN,
SECRET, PASSWORD, PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or
ACCESS_KEY (IsSecretVariable), unless ChildOptions::keptEnvironment
names it; names compare without case on Windows.

--pass-env=NAME, repeatable, and "pass-env" in catch3.json keep a
variable for the tests. The runner itself still starts with the whole
environment, so code that runs before the first worker sees it;
docs/progmasoft-runner.md says so.

A runner test starts the shell's environment listing with a secret and
a plain variable set, sees only the plain one, and sees the secret once
it is kept.

1 files changed, 1 insertions, 0 deletions

diff --git a/docs/command-line.md b/docs/command-line.md
index 4bd46f3b..236128e1 100644
--- a/docs/command-line.md
+++ b/docs/command-line.md
@@ -71,6 +71,7 @@ Without a spec, every test runs except hidden ones, whose tags start with
 | `-j`, `--jobs=N` | worker processes; 0, the default, uses one per hardware thread |
 | `--in-process` | run the tests in this process, one after another |
 | `--isolate` | start a fresh process for every test |
+| `--pass-env=NAME` | give the tests the variable `NAME`, which they do not get because its name looks like a secret (repeatable) |
 | `--timeout=SECONDS` | the limit for a test without history, and the cap of learned limits; 0 for none |
 | `--no-adaptive-timeout` | use `--timeout` for every test |
 | `--retries=N\|auto\|off` | `auto` (default) retries what may pass again; N retries every failure up to N times |