Skip to content

[BUG]: sensitive output (actions/runners/registration-token) can't be masked #213

Open
@dennisameling

Description

What happened?

Consider the following Actions config:

   - name: Generate Actions Runner token
      uses: octokit/[email protected]
      id: generate-actions-runner-token
      with:
        route: POST /repos/{owner}/{repo}/actions/runners/registration-token
        owner: ${{ env.ACTIONS_RUNNER_ORG }}
        repo: ${{ env.ACTIONS_RUNNER_REPO }}
      env:
        GITHUB_TOKEN: ${{ secrets.GH_API_PAT }}

   - name: Set and mask Actions Runner token for next steps
     run: |
        # We need to mask the token first before setting it to an env variable
        echo "::add-mask::${{ fromJson(steps.generate-actions-runner-token.outputs.data).token }}"
        ACTIONS_RUNNER_TOKEN=${{ fromJson(steps.generate-actions-runner-token.outputs.data).token }}
        echo ACTIONS_RUNNER_TOKEN=$ACTIONS_RUNNER_TOKEN >> $GITHUB_ENV    

This actually exposes the token to the CI logs, as also reported in this issue: actions/runner#475

image

You might want to add a warning about this to the README of this action or find another solution to hide this sensitive data. Thanks!

Versions

octokit/[email protected]

Relevant log output

See above

Code of Conduct

  • I agree to follow this project's Code of Conduct

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Good first issueGood for newcomersStatus: Up for grabsIssues that are ready to be worked on by anyoneType: BugSomething isn't working as documentedhacktoberfestIssues for participation in Hacktoberfest

    Type

    No type

    Projects

    • Status

      🔥 Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions