Question

A workflow calls an internal API using a token stored in the repository secret API_TOKEN. A developer wants to derive a shortened 'client key' from the token at runtime (the first 12 characters) and print it to the log for debugging, while ensuring GitHub still masks the full secret. Which approach correctly prevents the full secret from leaking in logs?

Accepted Answer

Compute the substring in a step and register it with the workflow command `echo "::add-mask::$CLIENT_KEY"` before echoing it, keeping the full secret in an environment variable set from the secret.

Answer

Reference ${{ secrets.API_TOKEN }} directly in a run step's echo command, since GitHub only masks secrets that are never printed.

Answer

Store the token in GITHUB_ENV so it becomes an environment variable, which automatically disables masking but makes debugging output safe.

Answer

Print the token using `${{ toJSON(secrets) }}` because the toJSON function encodes secrets in a masked, non-reversible format.