Skip to content

Docs: add warning about masking tokens in GitHub Actions (Fix #213) #335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
BurramsettyAkshayaPranathi wants to merge 1 commit into from
Closed

Docs: add warning about masking tokens in GitHub Actions (Fix #213) #335

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,21 @@ jobs:
- run: "echo latest release: '${{ steps.get_latest_release.outputs.data }}'"
```


> ⚠️ **Important Note**
>
> When using this action to call endpoints such as
> `POST /repos/{owner}/{repo}/actions/runners/registration-token`,
> the returned token may appear in your GitHub Actions logs.
>
> To protect secrets, manually mask the token in subsequent steps using:
>
> ```bash
> echo "::add-mask::${{ fromJson(steps.<step-id>.outputs.data).token }}"
> ```
>
> This ensures sensitive data is not exposed in your workflow logs.

More complex examples involving `POST`, setting custom media types, and parsing output data

```yml
Expand Down