Oliver Kieselbach 9f46adcdfa ci: the storage auth helper masks its token in the run log, like the Key Vault token ...

GitHub masks only secrets.* by itself. The bearer token Get-StorageAuthHeaders.ps1
mints at run time was never registered as a mask, unlike the Key Vault signing token,
which build-agent, build-msi and publish-scripts mask before exporting it. No caller
prints it today -- every call site captures the hashtable and passes it only as
-Headers -- but this repository's run logs are public, and a single debugging line
would have published it: an uncaptured call of the helper, or Get-Error /
Format-List on a failed request, whose TargetObject is the HttpRequestMessage
including the Authorization header (reproduced locally with a dummy token).

The helper now emits ::add-mask:: for every token it hands out, which covers all six
workflows in one place. Write-Host, never Write-Output: the output stream is the
script's return value. Verified with a mocked az that the result stays one hashtable
and that a nested caller in the Request-BuildNumber.ps1 pattern still returns only
its build number. Only under GITHUB_ACTIONS -- locally the line would print the token
instead of hiding it.

Prompted by an external AI review of the public scripts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-04 12:52:01 +02:00

..

Get-StorageAuthHeaders.ps1

ci: the storage auth helper masks its token in the run log, like the Key Vault token

2026-10-04 12:52:01 +02:00

Publish-BootstrapScripts.ps1

fix(publish): serve the customer scripts as a download, not as a web page

2026-09-08 21:07:35 +02:00

Request-BuildNumber.ps1

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00