From 29be32f123757f08145fe495a09badc61ba01899 Mon Sep 17 00:00:00 2001
From: Erik Burton <erik.burton@smartcontract.com>
Date: Thu, 27 Nov 2025 20:15:28 -0800
Subject: [PATCH] [receiver/prometheusreceiver] fix marshaling for
 prometheus/common/config.Secret types

---
 ...ceiver-basic-auth-password-marshaling.yaml | 27 +++++++++++++++++++
 receiver/prometheusreceiver/config.go         |  2 +-
 receiver/prometheusreceiver/config_test.go    | 22 +++++++++++++++
 3 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 .chloggen/fix_prom-receiver-basic-auth-password-marshaling.yaml

diff --git a/.chloggen/fix_prom-receiver-basic-auth-password-marshaling.yaml b/.chloggen/fix_prom-receiver-basic-auth-password-marshaling.yaml
new file mode 100644
index 0000000000000..4ccac8016222c
--- /dev/null
+++ b/.chloggen/fix_prom-receiver-basic-auth-password-marshaling.yaml
@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
+component: receiver/prometheus
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "Fixes yaml marshaling of prometheus/common/config.Secret types"
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [44445]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []
diff --git a/receiver/prometheusreceiver/config.go b/receiver/prometheusreceiver/config.go
index efc6aee51cf3b..794079cafa032 100644
--- a/receiver/prometheusreceiver/config.go
+++ b/receiver/prometheusreceiver/config.go
@@ -189,7 +189,7 @@ func reloadPromConfig(dst *PromConfig, src any) error {
 	yamlOut, err := yaml.MarshalWithOptions(
 		src,
 		yaml.CustomMarshaler(func(s commonconfig.Secret) ([]byte, error) {
-			return []byte(s), nil
+			return yaml.Marshal(string(s))
 		}),
 	)
 	if err != nil {
diff --git a/receiver/prometheusreceiver/config_test.go b/receiver/prometheusreceiver/config_test.go
index 9bc341de5d8f4..2f0b403d3b7a2 100644
--- a/receiver/prometheusreceiver/config_test.go
+++ b/receiver/prometheusreceiver/config_test.go
@@ -514,6 +514,28 @@ scrape_configs:
 				assert.Equal(t, "mySuperSecretCertificateKey", key, "client_certificate_key should preserve original value")
 			},
 		},
+		{
+			name: "basic auth password starting with %",
+			configYAML: `
+scrape_configs:
+  - job_name: "foo"
+    basic_auth:
+      username: "user"
+      password: "%password"
+    static_configs:
+      - targets: ["target:8000"]
+`,
+			checkFn: func(t *testing.T, dst *PromConfig) {
+				require.Len(t, dst.ScrapeConfigs, 1)
+				scrapeConfig := dst.ScrapeConfigs[0]
+				assert.Equal(t, "foo", scrapeConfig.JobName)
+
+				// Ensure basic_auth is present
+				require.NotNil(t, scrapeConfig.HTTPClientConfig.BasicAuth, "basic auth should be configured")
+				password := string(scrapeConfig.HTTPClientConfig.BasicAuth.Password)
+				assert.Equal(t, "%password", password, "password should preserve original value with leading %")
+			},
+		},
 	}
 
 	for _, tt := range tests {