Secret value leaked in Github Action logs

[somethingnew2-0]

When using this Github Action, the secret value to be set as an input is logged in the Github Action logs that is publicly accessible to anyone logged into Github for public Github repositories.

For example in the Github Action logs it looks like:

Run hmanzur/[email protected]
  with:
    name: REPOSITORY_SECRET_TO_SET
    value: "Secret is leaked here in plaintext"
    repository: my-user/my-public-repository
    token: ***

I do not know of a workaround to redact this information from Github Action logs as it appears that only secrets specified as inputs like {{ secrets.MY_REPOSITORY_SECRET }} will be properly redacted which unfortunately defeats the purpose of this module.

My recommendation is that no one should use this Github Action module unless their Github Action logs are properly protected, redacted, or has a minimal retention window of 0 days.

See ericanastas/deploy-google-app-script-action#1 for more details

[erbridge]

You're looking for the add-mask command:

echo "::add-mask::MY_SECRET_VALUE"