Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Added warning to documentation. #37411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
Loading
from
Draft

Added warning to documentation. #37411

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Added warning to documentation. 
These strings leaking has been a known issue since at least 5 years (See github issue: actions/runner#475) regardless of whether or not this will ever be fixed the least that can be done is give the user a heads up that these 2 use cases will not mask the values. (Removing the 2 sections in their entirety might also be an option 馃).
  • Loading branch information
@tobias-wilfert
tobias-wilfert authored Apr 8, 2025
commit 454ad4798cc2161cc8b62e0d40e146e6a0859432
4 changes: 4 additions & 0 deletions 4 ...kflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,7 @@ Write-Output "::add-mask::Mona The Octocat"

> [!WARNING]
> Make sure you register the secret with 'add-mask' before outputting it in the build logs or using it in any other workflow commands.
> This will still leak the string initialy as part of the echo statment.
Copy link
Contributor

@jsoref jsoref Apr 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

At the very least:

Suggested change
> This will still leak the string initialy as part of the echo statment.
> This will still leak the string initially as part of the echo statement.


### Example: Masking an environment variable

Expand Down Expand Up @@ -324,6 +325,9 @@ jobs:

{% endpowershell %}

> [!WARNING]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the gist is correct that you can't actually use an env: block to set an unmasked secret and thus this section should be changed to just say as much:

Important

Values set via an env: block in a workflow will be logged. Trying to mask in the step would be too late.
Masking would have to be done beforehand or by providing a file with the data and then reading the value, masking, and setting the variable locally within the shell context.

> This will still leak the string as part of the env.

### Example: Masking a generated output within a single job

If you do not need to pass your secret from one job to another job, you can:
Expand Down
Loading
Morty Proxy This is a proxified and sanitized view of the page, visit original site.