How to mask a secret when xtrace is used

[electriquo]

Select Topic Area

Question

Body

How can I mask sensitive data when bash trace flag (-x) is used?

For example, the workflow below reveals the_secret because set -x is used, which outputs every bash command to the screen

on:
  pull_request:
jobs:
  generate-a-secret-output:
    runs-on: ubuntu-latest
    steps:
      - name: Generate, mask, and output a secret
        run: |
          set -x
          the_secret=$((RANDOM))
          echo "::add-mask::$the_secret"
          echo "secret-number=$the_secret"

And in the output below, you can see the value of the_secret variable.

Run set -x
  set -x
  the_secret=$((RANDOM))
  echo "::add-mask::$the_secret"
  echo "secret-number=$the_secret"
  shell: /usr/bin/bash -e {0}
+ the_secret=28879
+ echo ::add-mask::28879
+ echo secret-number=28879
secret-number=***

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[electriquo]

Not stale