Method generateSecretRedactionStep

pkg/workflow/redact_secrets.go:144–204

(yaml *strings.Builder, yamlContent string, data *WorkflowData)

}

func (c *Compiler) generateSecretRedactionStep(yaml *strings.Builder, yamlContent string, data *WorkflowData) {
	// Extract secret references from the generated YAML
	secretReferences := CollectSecretReferences(yamlContent)

	// Always record that we're adding a secret redaction step, even if no secrets found
	// This is important for validation to ensure the step ordering is correct
	c.stepOrderTracker.RecordSecretRedaction("Redact secrets in logs")

	// If no secrets found, we still generate the step but it will be a no-op at runtime
	// This ensures consistent step ordering and validation
	if len(secretReferences) == 0 {
		secretMaskingLog.Print("No secrets found, generating no-op redaction step")
		// Generate a minimal no-op redaction step for validation purposes
		yaml.WriteString("      - name: Redact secrets in logs\n")
		yaml.WriteString("        if: always()\n")
		yaml.WriteString("        run: echo 'No secrets to redact'\n")
	} else {
		secretMaskingLog.Printf("Generating redaction step for %d secret(s)", len(secretReferences))
		yaml.WriteString("      - name: Redact secrets in logs\n")
		yaml.WriteString("        if: always()\n")
		fmt.Fprintf(yaml, "        uses: %s\n", getCachedActionPin("actions/github-script", data))
		yaml.WriteString("        with:\n")
		yaml.WriteString("          script: |\n")

		// Load redact_secrets script from external file
		// Use setupGlobals helper to attach GitHub Actions builtin objects to global scope
		yaml.WriteString("            const { setupGlobals } = require('" + SetupActionDestination + "/setup_globals.cjs');\n")
		yaml.WriteString("            setupGlobals(core, github, context, exec, io, getOctokit);\n")
		yaml.WriteString("            const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');\n")
		yaml.WriteString("            await main();\n")

		// Add environment variables
		yaml.WriteString("        env:\n")

		// Pass the list of secret names as a comma-separated string
		// Escape each secret reference to prevent injection when embedding in YAML
		escapedRefs := make([]string, len(secretReferences))
		for i, ref := range secretReferences {
			escapedRefs[i] = escapeSingleQuoteBackslash(ref)
		}
		fmt.Fprintf(yaml, "          GH_AW_SECRET_NAMES: '%s'\n", strings.Join(escapedRefs, ","))

		// Pass the actual secret values as environment variables so they can be redacted
		// Each secret will be available as an environment variable
		for _, secretName := range secretReferences {
			// Escape secret name to prevent injection in YAML
			escapedSecretName := escapeSingleQuoteBackslash(secretName)
			// Use original secretName in GitHub Actions expression since it's already validated
			// to only contain safe characters (uppercase letters, numbers, underscores)
			fmt.Fprintf(yaml, "          SECRET_%s: ${{ secrets.%s }}\n", escapedSecretName, secretName)
		}
	}

	// Inject custom secret masking steps if configured
	if data.SecretMasking != nil && len(data.SecretMasking.Steps) > 0 {
		secretMaskingLog.Printf("Injecting %d custom secret masking steps", len(data.SecretMasking.Steps))
		for _, step := range data.SecretMasking.Steps {
			c.generateCustomSecretMaskingStep(yaml, step, data)