bircni 68c6a5b4f1 feat: mask secrets that reach the log in an encoded form (#1108) ...

Only the verbatim value of a secret was masked, so a secret leaked through an action that serialized it stayed readable: `toJSON(secrets)` escapes it, an Authorization header carries it base64-encoded, a URL percent-encodes it. Each secret and `::add-mask::` value is now masked in those forms too, matching the value encoders of GitHub's runner. Encodings that leave the value unchanged are skipped, so a plain token still costs a single replacement pair. Includes regression tests.

Reviewed-on: https://gitea.com/gitea/runner/pulls/1108
Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com>

2026-07-31 12:35:10 +00:00

..

reporter_test.go

feat: mask secrets that reach the log in an encoded form (#1108)

2026-07-31 12:35:10 +00:00

reporter.go

feat: propagate proxy variables to jobs, services and builds (#1112)

2026-07-30 08:15:48 +00:00