Repository: helmfile/helmfile (Go)

Issue:
[Regression] Registry password printed to stdout by `repos` on error
### Operating system

Ubuntu 22.04.3 LTS

### Helmfile Version

0.157.0

### Helm Version

v3.13.0

### Bug description

When `repos` fails to login to a Helm repository with `helm registry login`, it prints the registry password to stdout. This can be dangerous when the helmfile execution logs are readable. 

It looks like the issue was introduced by the following commit by @yxxhero : https://github.com/helmfile/helmfile/commit/cfa89d4040b1a537252bbc012d3ee8366c05fa14#diff-cc23d827ce15a3ce002578cc0b18d846fd3614d59ac080c703bdd17881466795R235. Before the commit, `password` was not passed in the command args, only in the `helm.execStdin` call below.

### Example helmfile.yaml

repositories:
- name: roboll
  url: roboll.io/charts
  username: test
  password: test1234
  oci: true
  passCredentials: true
  verify: true

releases:
  - name: vault                            # name of this release
    namespace: vault                     # target namespace
    chart: roboll/vault-secret-manager

### Error message you've seen (if any)

$ helmfile repos
Logging in to registry
in ./helmfile.yaml: command "/usr/local/bin/helm" exited with non-zero status:

PATH:
  /usr/local/bin/helm

ARGS:
  0: helm (4 bytes)
  1: registry (8 bytes)
  2: login (5 bytes)
  3: roboll.io/charts (16 bytes)
  4: --username (10 bytes)
  5: test (4 bytes)
  6: --password-stdin (16 bytes)
  **7: test1234 (8 bytes)**

ERROR:
  exit status 1

EXIT STATUS
  1

STDERR:
  time="2024-01-08T15:50:04-05:00" level=info msg="Error logging in to endpoint, trying next endpoint" error="Get \"https://roboll.io/v2/\": dial tcp: lookup roboll.io on 172.27.160.1:53: no such host"
  Error: Get "https://roboll.io/v2/": dial tcp: lookup roboll.io on 172.27.160.1:53: no such host

COMBINED OUTPUT:
  time="2024-01-08T15:50:04-05:00" level=info msg="Error logging in to endpoint, trying next endpoint" error="Get \"https://roboll.io/v2/\": dial tcp: lookup roboll.io on 172.27.160.1:53: no such host"
  Error: Get "https://roboll.io/v2/": dial tcp: lookup roboll.io on 172.27.160.1:53: no such host

### Steps to reproduce

helmfile repos

### Working Helmfile Version

0.154.0

### Relevant discussion

_No response_


Discussion:

Patch:
diff --git a/pkg/helmexec/exec.go b/pkg/helmexec/exec.go
index 8b8d5d59c..700c6957a 100644
--- a/pkg/helmexec/exec.go
+++ b/pkg/helmexec/exec.go
@@ -210,7 +210,6 @@ func (helm *execer) RegistryLogin(repository, username, password, caFile, certFi
 		return nil
 	}
 
-	buffer := bytes.Buffer{}
 	args := []string{
 		"registry",
 		"login",
@@ -232,7 +231,8 @@ func (helm *execer) RegistryLogin(repository, username, password, caFile, certFi
 		args = append(args, "--insecure")
 	}
 
-	args = append(args, "--username", username, "--password-stdin", password)
+	args = append(args, "--username", username, "--password-stdin")
+	buffer := bytes.Buffer{}
 	buffer.Write([]byte(fmt.Sprintf("%s\n", password)))
 
 	helm.logger.Info("Logging in to registry")


Test patch:
diff --git a/pkg/helmexec/exec_test.go b/pkg/helmexec/exec_test.go
index 30bbaccc8..2a703c4e4 100644
--- a/pkg/helmexec/exec_test.go
+++ b/pkg/helmexec/exec_test.go
@@ -283,6 +283,43 @@ exec: helm --kube-context dev repo update
 	}
 }
 
+func Test_RegistryLogin(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := &execer{
+		helmBinary:  "helm",
+		version:     semver.MustParse("v3.12.0"),
+		logger:      logger,
+		kubeContext: "dev",
+		runner:      &mockRunner{},
+	}
+	err := helm.RegistryLogin("repo.example.com", "example_user", "example_password", "example_ca", "example_cert", "example_key", true)
+	expected := `Logging in to registry
+exec: helm --kube-context dev registry login repo.example.com --cert-file example_cert --key-file example_key --ca-file example_ca --insecure --username example_user --password-stdin
+`
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if buffer.String() != expected {
+		t.Errorf("helmexec.RegistryLogin()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	// Test helm version prior to v3.12.0, without support for TLS
+	buffer.Reset()
+	helm.version = semver.MustParse("v3.11.0")
+
+	err = helm.RegistryLogin("repo.example.com", "example_user", "example_password", "example_ca", "example_cert", "example_key", true)
+	expected = `Logging in to registry
+exec: helm --kube-context dev registry login repo.example.com --insecure --username example_user --password-stdin
+`
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if buffer.String() != expected {
+		t.Errorf("helmexec.RegistryLogin()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
 func Test_SyncRelease(t *testing.T) {
 	var buffer bytes.Buffer
 	logger := NewLogger(&buffer, "debug")