Setting secret mask for whole pipeline

Hello!

We've started to use 1Password for managing our infrastructure secrets. I've built a lot around it to make it work nicely for us and keeps our credentials in a nice tidy format.

Sadly no plugin exists for injecting secrets from 1Password into Jenkins yet, (like what exists already for Hashicorp Vault or AWS Secret Manager).

I've written a python script that will fetch the secrets from the 1Password API and return the secret value in stdout. However, I need to mask/obfuscate the returned values throughout my pipeline. They can be used in lots of different stages throughout the pipeline, so constantly declaring them as secrets using MaskPasswordsBuildWrapper is messy and unrealistic when I have lots of steps that use lots of different secrets.

Is there any way to do this once for the whole pipeline?

To help explain what I mean, here's an example pipeline:

pipeline {
    environment {
        OP_CONNECT_TOKEN = credentials('op-vault-token')
        A_NICE_ENV_FROM_SECRET = fetch_op_secret("vault-name", "secret-name", "password")
    }
    stages {
        stage('Do stuff') {
            steps {
                sh 'echo $A_NICE_ENV_FROM_SECRET'
            }
        }
        [... lots more stages using the same and many more secrets...]
    }

}

def fetch_op_secret(String vaultName, String secretName, String secretElement) {
    return sh(script: 'SECRET_ELEMENT="' + secretElement + '" SECRET_NAME="' + secretName + '" VAULT_NAME="' + vaultName + '" python op-jenkins.py', returnStdout: true).trim()
}

So we fetch the secret by running a python script, that will print to stdout the credential/password etc.

Ideally, in the fetch_op_secret function, I'd like to say "okay, whatever this script returns you should mask for the rest of this pipeline please".

I can do this with Github Actions doing something like `::add-mask::{value}` - can I do anything similar in my function?

Thanks!