Skip to content

[BUG]: sensitive output (actions/runners/registration-token) can't be masked #213

Open
@dennisameling

Description

@dennisameling

What happened?

Consider the following Actions config:

   - name: Generate Actions Runner token
      uses: octokit/[email protected]
      id: generate-actions-runner-token
      with:
        route: POST /repos/{owner}/{repo}/actions/runners/registration-token
        owner: ${{ env.ACTIONS_RUNNER_ORG }}
        repo: ${{ env.ACTIONS_RUNNER_REPO }}
      env:
        GITHUB_TOKEN: ${{ secrets.GH_API_PAT }}

   - name: Set and mask Actions Runner token for next steps
     run: |
        # We need to mask the token first before setting it to an env variable
        echo "::add-mask::${{ fromJson(steps.generate-actions-runner-token.outputs.data).token }}"
        ACTIONS_RUNNER_TOKEN=${{ fromJson(steps.generate-actions-runner-token.outputs.data).token }}
        echo ACTIONS_RUNNER_TOKEN=$ACTIONS_RUNNER_TOKEN >> $GITHUB_ENV    

This actually exposes the token to the CI logs, as also reported in this issue: actions/runner#475

image

You might want to add a warning about this to the README of this action or find another solution to hide this sensitive data. Thanks!

Versions

octokit/[email protected]

Relevant log output

See above

Code of Conduct

  • I agree to follow this project's Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    Good first issueGood for newcomersStatus: Up for grabsIssues that are ready to be worked on by anyoneType: BugSomething isn't working as documentedhacktoberfestIssues for participation in Hacktoberfest

    Type

    No type

    Projects

    Status

    🔥 Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions