skip to content

detached e66e40e

docs(executor): say the truncated base64 masks go beyond actions/runner

commit: e66e40ed81d18f54dbace6980b4dc689b0b1ca1d
author: brice · 9d ago · 2026-10-13 04:39 UTC
parent: cc22a18
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +2 -2

M internal/executor/masker.go +2 -2


@@ -21,8 +21,8 @@ import (
21	21		// Bytes that follow the secret change the last, incomplete group of its base64
22	22		// (`echo "$T" \| base64` appends a newline), so each base64 form is also
23	23		// registered without that group: only the characters the secret alone
24		-	// determines. (The actions/runner sources are not in $CLONED_REPOS_HOME, so
25		-	// this was not compared with its ValueEncoders.)
	24	+	// determines. actions/runner (ValueEncoders.Base64StringEscapeShift) only
	25	+	// registers the full forms; the truncated ones are an addition.
26	26		type masker struct{ values []string }
27	27
28	28		const maskedValue = "***"


@@ -21,8 +21,8 @@ import (
21		// Bytes that follow the secret change the last, incomplete group of its base64	21		// Bytes that follow the secret change the last, incomplete group of its base64
22		// (`echo "$T" \| base64` appends a newline), so each base64 form is also	22		// (`echo "$T" \| base64` appends a newline), so each base64 form is also
23		// registered without that group: only the characters the secret alone	23		// registered without that group: only the characters the secret alone
24	-	// determines. (The actions/runner sources are not in $CLONED_REPOS_HOME, so	24	+	// determines. actions/runner (ValueEncoders.Base64StringEscapeShift) only
25	-	// this was not compared with its ValueEncoders.)	25	+	// registers the full forms; the truncated ones are an addition.
26		type masker struct{ values []string }	26		type masker struct{ values []string }
27			27
28		const maskedValue = "***"	28		const maskedValue = "***"