How to mask a multi-line value in GitHub actions?

user_368691 0
Viewed 529

Action:

- id: sets-a-secret
  run: |
    local_secret=$(doppler secrets get GAR_JSON_KEY --plain)
    echo "::add-mask::$local_secret"
    echo "::set-output name=my-secret::$local_secret"
  env:
    DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}

local_secret is equal to:

{
  "type": "service_account",
  "project_id": "contrawork"
}

In GitHub log only the first line of the value is hidden:

##[debug]/usr/bin/bash -e /var/actions-runner/_runners/1/_work/_temp/10dcce73-cb22-43d9-853d-6c9674f6895e.sh
::add-mask::***
  "type": "service_account",
  "project_id": "contrawork"
}
::set-output name=my-secret::***
##[debug]steps['sets-a-secret']['outputs']['my-secret']='***'
  "type": "service_account",
  "project_id": "contrawork"
}
##[debug]Finishing: Run local_secret=$(doppler secrets get GAR_JSON_KEY --plain)

What's the correct way to use add-mask to avoid exposing a multi-line value in the output?

github-actions
1 Answers

You can do that by masking each line.

Here's an example:

name: Multiline variables

on:
  push:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
        
      - name: Set multiline env variable
        run: |
          echo 'MULTI<<EOF' >> $GITHUB_ENV
          echo -e "Test\nstring" >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - name: Mask multiline env
        run: |
         while read -r line;
         do
           echo "::add-mask::${line}"
         done <<< "${{ env.MULTI }}"
        
      - name: Print multiline secret
        run: echo -e "${{ env.MULTI }}"
user_5767520
Related