fix: mask inferred OTLP access tokens (#50774)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.changeset/patch-mask-inferred-otlp-tokens.md

@@ -13,12 +13,22 @@
 
 const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
 
+/**
+ * Mask a token discovered by this inline github-script before it can be used
+ * or exposed as an output.
+ *
+ * @param {unknown} value
+ */
+function maskSecret(value) {
+  core.setSecret(String(value));
+}
+
 async function main() {
   const oidcToken = process.env.GH_AW_OTLP_OIDC_TOKEN;
   if (!oidcToken) {
     throw new Error("Missing GitHub OIDC token for Google workload identity token exchange");
   }
-  core.setSecret(oidcToken);
+  maskSecret(oidcToken);
 
   const response = await fetch("https://sts.googleapis.com/v1/token", {
     method: "POST",
@@ -44,7 +54,7 @@ async function main() {
   if (!accessToken) {
     throw new Error("Google workload identity token exchange returned no access token");
   }
-  core.setSecret(accessToken);
+  maskSecret(accessToken);
 
   const serviceAccount = process.env.GH_AW_OTLP_WIF_SERVICE_ACCOUNT;
   if (serviceAccount) {
@@ -64,7 +74,7 @@ async function main() {
     if (!accessToken) {
       throw new Error("Google service account impersonation returned no access token");
     }
-    core.setSecret(accessToken);
+    maskSecret(accessToken);
   }
 
   core.setOutput("token", accessToken);

actions/setup/js/exchange_otlp_workload_identity.cjs

@@ -60,6 +60,7 @@ describe("exchange_otlp_workload_identity", () => {
     expect(mockCore.setSecret).toHaveBeenCalledWith("github-oidc-token");
     expect(mockCore.setSecret).toHaveBeenCalledWith("federated-token");
     expect(mockCore.setOutput).toHaveBeenCalledWith("token", "federated-token");
+    expect(mockCore.setSecret.mock.invocationCallOrder[1]).toBeLessThan(mockCore.setOutput.mock.invocationCallOrder[0]);
   });
 
   it("impersonates the service account when configured", async () => {
@@ -75,6 +76,8 @@ describe("exchange_otlp_workload_identity", () => {
     expect(options.headers.authorization).toContain("federated-token");
     expect(mockCore.setSecret.mock.calls).toEqual([["github-oidc-token"], ["federated-token"], ["impersonated-token"]]);
     expect(mockCore.setOutput).toHaveBeenCalledWith("token", "impersonated-token");
+    expect(mockCore.setSecret.mock.invocationCallOrder[1]).toBeLessThan(fetchMock.mock.invocationCallOrder[1]);
+    expect(mockCore.setSecret.mock.invocationCallOrder[2]).toBeLessThan(mockCore.setOutput.mock.invocationCallOrder[0]);
   });
 
   it("does not call the impersonation endpoint when no service account is configured", async () => {