fix: mask vercel token in logs, sanitize commit metadata, and preserve retry error context

- Add core.setSecret(vercelToken) to prevent token leakage in action logs
- Sanitize commit message (strip newlines/quotes) before passing as metadata
- Preserve original error output when retry path also fails
- Remove core.exportVariable for VERCEL_ORG_ID (process.env delete suffices)

Author: amondnet

dist/index.js

@@ -59652,6 +59652,7 @@ function getVercelBin() {
 }
 
 const vercelToken = core.getInput('vercel-token', { required: true })
+core.setSecret(vercelToken)
 const vercelArgs = core.getInput('vercel-args')
 const vercelOrgId = core.getInput('vercel-org-id')
 const vercelProjectId = core.getInput('vercel-project-id')
@@ -59745,7 +59746,7 @@ function buildDeployArgs(providedArgs, ref, commit, sha, commitOrg, commitRepo)
     ...addVercelMetadata('githubRepo', context.repo.repo, providedArgs),
     ...addVercelMetadata('githubCommitOrg', commitOrg, providedArgs),
     ...addVercelMetadata('githubCommitRepo', commitRepo, providedArgs),
-    ...addVercelMetadata('githubCommitMessage', `"${commit}"`, providedArgs),
+    ...addVercelMetadata('githubCommitMessage', `"${commit.replace(/[\r\n]+/g, ' ').replace(/"/g, '')}"`, providedArgs),
     ...addVercelMetadata(
       'githubCommitRef',
       ref.replace('refs/heads/', ''),
@@ -59799,15 +59800,21 @@ async function vercelDeploy(ref, commit, sha, commitOrg, commitRepo) {
         'Vercel CLI rejected the org ID as a personal account scope. '
         + 'Retrying without VERCEL_ORG_ID (VERCEL_PROJECT_ID is still set).',
       )
-      core.exportVariable('VERCEL_ORG_ID', '')
       delete process.env.VERCEL_ORG_ID
 
+      const originalOutput = myOutput
+      const originalError = myError
       myOutput = ''
       myError = ''
       const retryArgs = buildDeployArgs(providedArgs, ref, commit, sha, commitOrg, commitRepo)
       // Don't re-add --scope on retry — it may have caused the personal account error
 
       exitCode = await exec.exec('npx', [vercelBin, ...retryArgs], options)
+
+      if (exitCode !== 0) {
+        core.error(`Original attempt output:\n${originalOutput}`)
+        core.error(`Original attempt errors:\n${originalError}`)
+      }
     }
 
     if (exitCode !== 0) {

index.js

@@ -67,6 +67,7 @@ function getVercelBin() {
 }
 
 const vercelToken = core.getInput('vercel-token', { required: true })
+core.setSecret(vercelToken)
 const vercelArgs = core.getInput('vercel-args')
 const vercelOrgId = core.getInput('vercel-org-id')
 const vercelProjectId = core.getInput('vercel-project-id')
@@ -160,7 +161,7 @@ function buildDeployArgs(providedArgs, ref, commit, sha, commitOrg, commitRepo)
     ...addVercelMetadata('githubRepo', context.repo.repo, providedArgs),
     ...addVercelMetadata('githubCommitOrg', commitOrg, providedArgs),
     ...addVercelMetadata('githubCommitRepo', commitRepo, providedArgs),
-    ...addVercelMetadata('githubCommitMessage', `"${commit}"`, providedArgs),
+    ...addVercelMetadata('githubCommitMessage', `"${commit.replace(/[\r\n]+/g, ' ').replace(/"/g, '')}"`, providedArgs),
     ...addVercelMetadata(
       'githubCommitRef',
       ref.replace('refs/heads/', ''),
@@ -214,15 +215,21 @@ async function vercelDeploy(ref, commit, sha, commitOrg, commitRepo) {
         'Vercel CLI rejected the org ID as a personal account scope. '
         + 'Retrying without VERCEL_ORG_ID (VERCEL_PROJECT_ID is still set).',
       )
-      core.exportVariable('VERCEL_ORG_ID', '')
       delete process.env.VERCEL_ORG_ID
 
+      const originalOutput = myOutput
+      const originalError = myError
       myOutput = ''
       myError = ''
       const retryArgs = buildDeployArgs(providedArgs, ref, commit, sha, commitOrg, commitRepo)
       // Don't re-add --scope on retry — it may have caused the personal account error
 
       exitCode = await exec.exec('npx', [vercelBin, ...retryArgs], options)
+
+      if (exitCode !== 0) {
+        core.error(`Original attempt output:\n${originalOutput}`)
+        core.error(`Original attempt errors:\n${originalError}`)
+      }
     }
 
     if (exitCode !== 0) {