From 6d1a8d26ebbb5790fbfc0bcfe4854d310eb275e1 Mon Sep 17 00:00:00 2001 From: Aaron Mark Date: Tue, 18 Aug 2026 21:50:48 +0300 Subject: [PATCH] fix: stop treating OIDC username as a secret Usernames are not sensitive; marking them with setSecret caused unnecessary log redaction in workflows. Fixes #280 Signed-off-by: Aaron Mark --- lib/oidc-utils.js | 1 - src/oidc-utils.ts | 1 - test/oidc-utils.spec.ts | 4 ++-- 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/lib/oidc-utils.js b/lib/oidc-utils.js index e230a3326..087190ea9 100644 --- a/lib/oidc-utils.js +++ b/lib/oidc-utils.js @@ -173,7 +173,6 @@ class OidcUtils { } static setOidcStepOutputs(username, accessToken) { core.setSecret(accessToken); - core.setSecret(username); core.setOutput('oidc-token', accessToken); core.setOutput('oidc-user', username); } diff --git a/src/oidc-utils.ts b/src/oidc-utils.ts index a7b324ce2..972359207 100644 --- a/src/oidc-utils.ts +++ b/src/oidc-utils.ts @@ -157,7 +157,6 @@ export class OidcUtils { public static setOidcStepOutputs(username: string, accessToken: string): void { core.setSecret(accessToken); - core.setSecret(username); core.setOutput('oidc-token', accessToken); core.setOutput('oidc-user', username); } diff --git a/test/oidc-utils.spec.ts b/test/oidc-utils.spec.ts index 63f9d648d..f82e8029f 100644 --- a/test/oidc-utils.spec.ts +++ b/test/oidc-utils.spec.ts @@ -121,10 +121,10 @@ describe('OidcUtils', (): void => { }); describe('setOidcStepOutputs', (): void => { - it('should export user/token as step output and secret', (): void => { + it('should export user/token as step output and mark token as secret', (): void => { OidcUtils.setOidcStepOutputs('foo', 'bar'); expect(core.setSecret).toHaveBeenCalledWith('bar'); - expect(core.setSecret).toHaveBeenCalledWith('foo'); + expect(core.setSecret).not.toHaveBeenCalledWith('foo'); expect(core.setOutput).toHaveBeenCalledWith('oidc-token', 'bar'); expect(core.setOutput).toHaveBeenCalledWith('oidc-user', 'foo'); });