actions/wails-release
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Mask base64 cert and document add-mask stdout requirement

Browse source 
DeveloperIDCertBase64 is the .p12 contents and equally sensitive as
the password — register it with the log scrubber so a future code
path that accidentally wraps cfg in a debug log can't leak it. Also
documents why maskSecrets writes to stdout rather than stderr.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Leon Mika 2026-05-02 10:34:05 +10:00
parent 97fb47d023
commit 445c99e6c4
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
cmd/wails-release/main.go
View file

@ -189,8 +189,12 @@ func run(ctx context.Context) error {
return nil return nil
} }
// maskSecrets registers every credential value with the runner's log
// scrubber via ::add-mask:: directives. These directives MUST be written
// to stdout (not stderr) — the runner's command-parser only reads stdout.
func maskSecrets(c *config.Config) { func maskSecrets(c *config.Config) {
for _, v := range []string{ for _, v := range []string{
c.DeveloperIDCertBase64,
c.DeveloperIDCertPassword, c.DeveloperIDCertPassword,
c.NotarizationAPIKeyBase64, c.NotarizationAPIKeyBase64,
c.NotarizationApplePassword, c.NotarizationApplePassword,