Exposes secrets in plaintext

[kotyara85]

When using v0.2.1 actions output secrets in plaintext, here's an example

pipeline output

Run 
  echo "-----BEGIN OPENSSH PRIVATE KEY-----"
  

pipeline itself

on: push
jobs:
  test:
    strategy:
      matrix:
        go-version: [1.16.x]
    runs-on: self-hosted
    steps:
      - name: Import Secrets
        id: secrets
        uses: github/vault-action@v2.1.2
        with:
          url: https://vault:8200
          method: approle
          roleId: abc
          secretId: ${{ secrets.SECRETID }}
          tlsSkipVerify: true
          secrets: |
            secret/data/secret ssh-key | SSH_KEY ;
      - name: Install Go
        uses: actions/setup-go@v2
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Setup bitbucket
        run: |
          echo "${{ env.SSH_KEY }}" > ~/.ssh/id_rsa
      - name: Test
        run: make test

[jasonodonnell]

Thanks @kotyara85, this is indeed a bug introduced by a limitation in GH Actions toolkit. In the documentation I see this warning:

WARNING The add-mask and setSecret commands only support single line secrets. To register a multiline secrets you must register each line individually otherwise it will not be masked.

We'll get this fixed up and release a new provider. In the future, please send all security issues to security@hashicorp.com.