Hi everyone. I ran into a problem recently regarding github actions and it’s logs.
I need to run a cli command like how it’s available for aws. The parameters contain username and password.
What I did was, I created a JSON file with the username and password parameters, encrypted the same using GPG and stored the passphrase on github secrets.
In my workflow, I decrypted the same and to parse it I used:
content=cat $TMP/secret.json
content="{content//'%'/'%25'}" content="{content//'\n'/'%0A'}" content="{content//$’\r’/’%0D’}"
echo “::set-output name=json::$content”

To pass the username and password I used:
{{ fromJson(steps.var.outputs.json).username }} {{ fromJson(steps.var.outputs.json).password }}

The problem is when this expression gets evaluated it shows up in logs. To try and avoid this I did:
echo “::add-mask::{{ fromJson(steps.var.outputs.json).username }} echo "::set-output name=secret-username::{{ fromJson(steps.var.outputs.json).username }}”
echo “::add-mask::{{ fromJson(steps.var.outputs.json).password }}" echo "::set-output name=secret-password::{{ fromJson(steps.var.outputs.json).password }}”

Now in the CLI command the username and password seems to be masked, but still in the add-mask command it’s shown. It seems like expressions are evaluated and printed as commands before add-mask can register them.

Is there any workaround regarding the same?
My apologies regarding the long post.

Edit: I can’t seem to get the formatting right for the post. My apologies for that as well.