From bc256c234bf48ffdee7ae27409ebc7f9aa3c8ab4 Mon Sep 17 00:00:00 2001
From: Parker Brown <17183625+parkerbxyz@users.noreply.github.com>
Date: Fri, 25 Aug 2023 11:59:01 -0700
Subject: [PATCH] fix: mask the installation token in logs (#28)

The runner will automatically mask GitHub token formats it recognizes,
but sometimes a new pattern rolls out before the runner is updated to
recognize it.
---
 lib/main.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/main.js b/lib/main.js
index a55d7dc..977fcf8 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -52,6 +52,9 @@ export async function main(
     repositoryNames: [repo],
   });
 
+  // Register the token with the runner as a secret to ensure it is masked in logs
+  core.setSecret(authentication.token);
+
   core.setOutput("token", authentication.token);
 
   // Make token accessible to post function (so we can invalidate it)