Prevent OTLP placeholder masks from suppressing boolean job outputs by Copilot · Pull Request #69996 · github/gh-aw · GitHub
Skip to content

Prevent OTLP placeholder masks from suppressing boolean job outputs - #69996

Merged
pelikhan merged 3 commits into
mainfrom
copilot/fix-otlp-header-masking-issue
Oct 18, 2026
Merged

pelikhan merged 3 commits into
mainfrom
copilot/fix-otlp-header-masking-issue

Conversation

Copilot AI commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Masking an OTLP placeholder such as X-No-Auth=true causes GitHub Actions to drop outputs equal to true, silently breaking activation, credit-guardrail, and patch-detection conditions.

  • Individual-value masking: Require at least eight characters and exclude digit-only values, preventing boolean and short placeholders from becoming standalone masks.
  • Credential protection: Preserve whole-header and raw Bearer-token masking. Leave attribute masking unchanged.
  • Regression coverage: Cover boolean and numeric placeholders, the 7/8-character boundary, multiple endpoints, and short ****** Assert exact mask-command lines.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix masking of 4-character OTLP header values in setup action Prevent OTLP placeholder masks from suppressing boolean job outputs Oct 18, 2026
Copilot AI requested a review from pelikhan October 18, 2026 20:59
@pelikhan
pelikhan marked this pull request as ready for review October 18, 2026 21:24
Copilot AI max review requested due to automatic review settings October 18, 2026 21:24

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The JavaScript setup path still masks true, leaving the reported output-suppression bug unresolved.

1 open issue
What changed in this PR

Updates setup’s OTLP shell masking to protect boolean job outputs while preserving credential masking.

Changes:

  • Restrict individual plain-header masks to nonnumeric values of at least eight characters.
  • Add regression cases and exact mask-command assertions.
File Description
pkg/​workflow/​observability_otlp_mask_script_test.go Covers placeholders, length boundaries, multiple endpoints, and short Bearer tokens.
actions/​setup/​sh/​mask_otlp_headers.sh Filters individual header masks while retaining whole-header and raw Bearer-token masking.

Review effort: Max

Comment thread actions/setup/sh/mask_otlp_headers.sh
Separate setup runner-mask selection from artifact redaction, cover encoded placeholders and short auth credentials, and document the masking policy.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@pelikhan
pelikhan merged commit 439ba5f into main Oct 18, 2026
46 checks passed
@pelikhan
pelikhan deleted the copilot/fix-otlp-header-masking-issue branch October 18, 2026 22:36
@github-actions

Copy link
Copy Markdown
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Setup action masks a 4-character OTLP header value like true, which blanks every job output equal to true (v0.92.x regression)

3 participants