robojerk/codeql-action

Merge pull request #2930 from github/mbg/start-proxy/mask-tokens

Browse source 
Register credentials extracted from proxy configuration as secrets
This commit is contained in:
Michael B. Gale 2025-06-16 10:59:24 +01:00 • committed by GitHub
commit 2847b7f7ab
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 52 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/start-proxy.ts
View file

@ -1,3 +1,5 @@
import * as core from "@actions/core";
import { parseLanguage, Language } from "./languages";
import { Logger } from "./logging";
import { ConfigurationError } from "./util";
@ -63,6 +65,14 @@ export function getCredentials(
const out: Credential[] = [];
for (const e of parsed) {
// Mask credentials to reduce chance of accidental leakage in logs.
if (e.password !== undefined) {
core.setSecret(e.password);
}
if (e.token !== undefined) {
core.setSecret(e.token);
}
if (e.url === undefined && e.host === undefined) {
// The proxy needs one of these to work. If both are defined, the url has the precedence.
throw new ConfigurationError(