diff --git a/internal/actions/actions.go b/internal/actions/actions.go
new file mode 100644
index 0000000..6204fff
--- /dev/null
+++ b/internal/actions/actions.go
@@ -0,0 +1,32 @@
+package actions
+
+import (
+	"fmt"
+	"io"
+	"os"
+)
+
+// SetOutput appends "name=value\n" to the file referenced by $GITHUB_OUTPUT.
+// If outputFile is empty the call is a no-op (e.g. running locally).
+func SetOutput(outputFile, name, value string) error {
+	if outputFile == "" {
+		return nil
+	}
+	f, err := os.OpenFile(outputFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		return fmt.Errorf("open %s: %w", outputFile, err)
+	}
+	defer f.Close()
+	if _, err := fmt.Fprintf(f, "%s=%s\n", name, value); err != nil {
+		return fmt.Errorf("write %s: %w", outputFile, err)
+	}
+	return nil
+}
+
+// AddMask emits a workflow command that redacts the given value from logs.
+func AddMask(w io.Writer, value string) {
+	if value == "" {
+		return
+	}
+	fmt.Fprintf(w, "::add-mask::%s\n", value)
+}
diff --git a/internal/actions/actions_test.go b/internal/actions/actions_test.go
new file mode 100644
index 0000000..72d74dd
--- /dev/null
+++ b/internal/actions/actions_test.go
@@ -0,0 +1,46 @@
+package actions_test
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/leonmika/wails-release/internal/actions"
+)
+
+func TestSetOutput_AppendsKeyValueLine(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "outputs")
+
+	if err := actions.SetOutput(path, "version", "1.2.3"); err != nil {
+		t.Fatalf("unexpected: %v", err)
+	}
+	if err := actions.SetOutput(path, "artifact-path", "/dist/x.zip"); err != nil {
+		t.Fatalf("unexpected: %v", err)
+	}
+
+	got, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read: %v", err)
+	}
+	want := "version=1.2.3\nartifact-path=/dist/x.zip\n"
+	if string(got) != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+}
+
+func TestAddMask_WritesDirective(t *testing.T) {
+	var buf bytes.Buffer
+	actions.AddMask(&buf, "supersecret")
+	if !strings.Contains(buf.String(), "::add-mask::supersecret") {
+		t.Fatalf("unexpected output: %q", buf.String())
+	}
+}
+
+func TestSetOutput_NoFileSetIsNoop(t *testing.T) {
+	if err := actions.SetOutput("", "k", "v"); err != nil {
+		t.Fatalf("expected no error when path empty, got %v", err)
+	}
+}