aws_secret_mask_testing.yml

name: GHACodebuildRunnerSecretTesting

# this is a test of masking a block of secrets in a custom action. 
# all code seems to work as expected, but in the caller workflow, secrets still
# show in logs as unmasked.

on:
  pull_request:
    branches: [main]

jobs:
  test1:
    runs-on:
      - codebuild-cfpb-regtech-gha-test-1-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - name: 'Checkout GitHub Action'
        uses: actions/checkout@v4

      - name: Checkout To Path
        uses: actions/checkout@v4
        with:
          repository: 'cfpb/regtech-deployments'
          ref: 'test/gha-codebuild-runner'
          path: 'testing-action'

      - name: Mask Secrets Bulk
        id: mask-secrets-bulk
        uses: ./testing-action/.github/actions/mask_secrets_bulk
        with:
          secrets: |
            TEST_SECRET_1,cfpb/team/regtech/gha-codebuild-runner/test-secret-1
            TEST_SECRET_2,cfpb/team/regtech/gha-codebuild-runner/test-secret-2
            TEST_SECRET_3,arn:aws:secretsmanager:us-east-1:099248080076:secret:cfpb/team/regtech/gha-codebuild-runner/test-secret-3-9lVad8

      - name: check aws secrets
        id: check-aws-secrets
        run: |
          echo -e "show test-secret-1 ${{ env.TEST_SECRET_1 }}"
          echo -e "show test-secret-2 ${{ env.TEST_SECRET_2 }}"
          echo -e "show test-secret-3 ${{ env.TEST_SECRET_3 }}"