Mask secrets read by the JavaScript runtime

actions/setup/js/action_setup_otlp.cjs

@@ -29,6 +29,7 @@ require("./shim.cjs");
 const { appendFileSync } = require("fs");
 const { nowMs } = require("./performance_now.cjs");
 const { getActionInput } = require("./action_input_utils.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 /**
  * Append a key=value line to a GitHub Actions file (GITHUB_OUTPUT or GITHUB_ENV)
@@ -132,7 +133,7 @@ async function run() {
     process.env.INPUT_PARENT_SPAN_ID = inputParentSpanId;
   }
 
-  const inputOTLPOIDCToken = getActionInput("OTLP_OIDC_TOKEN");
+  const inputOTLPOIDCToken = (readSecretEnv("INPUT_OTLP_OIDC_TOKEN") || readSecretEnv("INPUT_OTLP-OIDC-TOKEN") || "").trim();
   if (inputOTLPOIDCToken) {
     const existingHeaders = process.env.OTEL_EXPORTER_OTLP_HEADERS || "";
     const mergedHeaders = mergeAuthorizationHeader(existingHeaders, inputOTLPOIDCToken);

actions/setup/js/apply_samples.cjs

@@ -38,6 +38,7 @@ const os = require("os");
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { ERR_VALIDATION, ERR_PARSE, ERR_SYSTEM, ERR_API, ERR_CONFIG } = require("./error_codes.cjs");
 const { findRepoCheckout } = require("./find_repo_checkout.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 const DEFAULT_BASE_BRANCH = process.env.GH_AW_CUSTOM_BASE_BRANCH || process.env.GITHUB_BASE_REF || process.env.GITHUB_REF_NAME || "main";
 const PATCH_SIDECAR_TOOLS = new Set(["create_pull_request", "push_to_pull_request_branch"]);
@@ -154,7 +155,7 @@ function readEventPayload() {
  */
 function selectTokenForRepo(owner, repo) {
   const slug = `${owner}/${repo}`;
-  const raw = process.env.GH_AW_REPO_TOKENS;
+  const raw = readSecretEnv("GH_AW_REPO_TOKENS");
   if (raw && raw.trim()) {
     try {
       const map = JSON.parse(raw);
@@ -165,7 +166,7 @@ function selectTokenForRepo(owner, repo) {
       core.warning(`apply_samples: GH_AW_REPO_TOKENS is not valid JSON, ignoring: ${getErrorMessage(err)}`);
     }
   }
-  return process.env.GITHUB_TOKEN || process.env.GH_TOKEN || undefined;
+  return readSecretEnv("GITHUB_TOKEN") || readSecretEnv("GH_TOKEN");
 }
 
 /**

actions/setup/js/artifact_client.cjs

@@ -16,6 +16,7 @@ const { pipeline } = require("stream/promises");
 const { spawnSync } = require("child_process");
 
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 const DEFAULT_RETRY_ATTEMPTS = 5;
 const RETRY_DELAY_MS = 5000;
@@ -55,7 +56,7 @@ function decodeJWTPayload(token) {
 }
 
 function getBackendIdsFromRuntimeToken() {
-  const token = process.env.ACTIONS_RUNTIME_TOKEN || "";
+  const token = readSecretEnv("ACTIONS_RUNTIME_TOKEN") || "";
   if (!token) {
     throw new Error("ACTIONS_RUNTIME_TOKEN is required for artifact upload");
   }
@@ -84,7 +85,7 @@ function getResultsServiceOrigin() {
 }
 
 async function twirpRequest(method, body) {
-  const runtimeToken = process.env.ACTIONS_RUNTIME_TOKEN || "";
+  const runtimeToken = readSecretEnv("ACTIONS_RUNTIME_TOKEN") || "";
   if (!runtimeToken) {
     throw new Error("ACTIONS_RUNTIME_TOKEN is required for artifact upload");
   }

actions/setup/js/assign_to_agent.cjs

@@ -9,6 +9,7 @@ const { isTemporaryId, normalizeTemporaryId, resolveRepoIssueTarget } = require(
 const { sleep } = require("./error_recovery.cjs");
 const { parseAllowedRepos, validateRepo, resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_helpers.cjs");
 const { resolvePullRequestRepo } = require("./pr_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 const { sanitizeContent } = require("./sanitize_content.cjs");
 const { normalizeIssueIntentMetadata } = require("./issue_intents.cjs");
 
@@ -33,7 +34,7 @@ let _allResults = [];
  * @returns {Promise<Object>} Authenticated GitHub client
  */
 async function createAssignToAgentGitHubClient(config) {
-  const token = config["github-token"] || process.env.GH_AW_ASSIGN_TO_AGENT_TOKEN;
+  const token = config["github-token"] || readSecretEnv("GH_AW_ASSIGN_TO_AGENT_TOKEN");
   if (!token) {
     core.debug("No dedicated agent token configured — using step-level github client for assign-to-agent operations");
     return github;

actions/setup/js/build_checkout_manifest.cjs

@@ -8,6 +8,7 @@ const path = require("path");
 const { execFileSync } = require("child_process");
 
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 function parseManifestEntries(entriesJSON = process.env.GH_AW_CHECKOUT_MANIFEST_ENTRIES || "[]") {
   let parsed;
@@ -33,7 +34,7 @@ function readManifestEntriesFromEnv() {
     entries.push({
       repository: process.env[`GH_AW_CHECKOUT_REPO_${i}`] || "",
       path: process.env[`GH_AW_CHECKOUT_PATH_${i}`] || "",
-      token: process.env[`GH_AW_CHECKOUT_TOKEN_${i}`] || "",
+      token: readSecretEnv(`GH_AW_CHECKOUT_TOKEN_${i}`) || "",
     });
   }
   return entries;

actions/setup/js/check_daily_aic_workflow_guardrail.cjs

@@ -10,6 +10,7 @@ const { calculateDailyAICStats, findJSONLFiles, formatAICCredits, sumAICFromUsag
 const { AIC_USAGE_CACHE_FILE_PATH, CACHE_RETENTION_MS, pruneStaleJSONLCacheLines } = require("./daily_aic_cache_helpers.cjs");
 const { parsePositiveCompactNumber } = require("./numeric_limits.cjs");
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 const { createRateLimitAwareGithub, fetchAndLogRateLimit } = require("./github_rate_limit_logger.cjs");
 
 const PRIMARY_GUARDRAIL_ARTIFACT_NAMES = ["usage"];
@@ -576,7 +577,7 @@ async function main() {
     return;
   }
 
-  const token = process.env.GH_AW_GITHUB_TOKEN || process.env.GITHUB_TOKEN || process.env.GH_TOKEN || "";
+  const token = readSecretEnv("GH_AW_GITHUB_TOKEN") || readSecretEnv("GITHUB_TOKEN") || readSecretEnv("GH_TOKEN") || "";
   if (!token) {
     core.setOutput("daily_ai_credits_guardrail_status", "skipped");
     core.warning("Skipping daily workflow AI Credits guardrail because no GitHub token was available for artifact lookup.");

actions/setup/js/check_workflow_recompile_needed.cjs

@@ -8,6 +8,7 @@ const { getGitAuthEnv } = require("./git_helpers.cjs");
 const { resolvePullRequestRepo } = require("./pr_helpers.cjs");
 const { pushSignedCommits } = require("./push_signed_commits.cjs");
 const { buildWorkflowRunUrl } = require("./workflow_metadata_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 const RECOMPILE_ISSUE_TITLE = "[aw] agentic workflows out of sync";
 const RECOMPILE_PR_TITLE = "[aw] recompile agentic workflows";
@@ -23,7 +24,7 @@ async function getEffectiveBaseBranch(owner, repo) {
 }
 
 function getRecompileToken() {
-  return process.env.GH_AW_MAINTENANCE_GITHUB_TOKEN || "";
+  return readSecretEnv("GH_AW_MAINTENANCE_GITHUB_TOKEN") || "";
 }
 
 function logConfiguration(createPullRequest) {

actions/setup/js/codex_harness.cjs

@@ -53,6 +53,7 @@ const { countPermissionDeniedIssues, hasNumerousPermissionDeniedIssues, extractD
 const { detectNonRetryableHarnessGuard, buildSoftTimeoutGuard, emitSoftTimeoutSignal, isAuthenticationFailedError } = require("./harness_retry_guard.cjs");
 const { MODEL_NOT_SUPPORTED_PATTERN: INVALID_MODEL_ERROR_PATTERN } = require("./detect_agent_errors.cjs");
 const { resolveRetryConfig } = require("./harness_retry_config.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 const { applyModelFallback, injectModelFlagAfterExec } = require("./model_fallback.cjs");
 const { parseMaxAICreditsExceededFromAuditLog } = require("./ai_credits_context.cjs");
 
@@ -494,8 +495,8 @@ async function main() {
   }
 
   // Diagnose API key presence so CI failures can be triaged without exposing secret values.
-  const codexApiKey = process.env.CODEX_API_KEY;
-  const openaiApiKey = process.env.OPENAI_API_KEY;
+  const codexApiKey = readSecretEnv("CODEX_API_KEY");
+  const openaiApiKey = readSecretEnv("OPENAI_API_KEY");
   const codexChildEnv = buildCodexChildEnv(process.env, codexApiKey, openaiApiKey);
   log(`secrets: CODEX_API_KEY=${codexApiKey ? `set (length=${codexApiKey.length})` : "not set"}` + ` OPENAI_API_KEY=${openaiApiKey ? `set (length=${openaiApiKey.length})` : "not set"}`);
 

actions/setup/js/copilot_sdk_driver.cjs

@@ -31,6 +31,7 @@ const { runWithCopilotSDK, extractPromptFromArgs } = require("./copilot_sdk_sess
 const { parsePermissionConfigFromServerArgs } = require("./copilot_sdk_permissions.cjs");
 const { parseMultiProviderJson } = require("./copilot_sdk_multi_provider.cjs");
 const { applyModelFallback } = require("./model_fallback.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 // Re-export the session and permission helpers so that existing callers that
 // require("./copilot_sdk_driver.cjs") (e.g. copilot_harness.cjs) continue to work.
@@ -72,7 +73,7 @@ async function main() {
     process.exit(1);
   }
 
-  const connectionToken = process.env.COPILOT_CONNECTION_TOKEN;
+  const connectionToken = readSecretEnv("COPILOT_CONNECTION_TOKEN");
   if (!connectionToken) {
     process.stderr.write("[copilot-sdk-driver] error: COPILOT_CONNECTION_TOKEN is required. This token is generated by copilot_harness.cjs and must be passed to the driver environment\n");
     process.exit(1);
@@ -94,7 +95,7 @@ async function main() {
   // The harness injects GH_AW_COPILOT_SDK_MULTI_PROVIDER_JSON before launching
   // this driver.  Multi-provider BYOK is the only supported mode.
 
-  const multiProviderConfig = parseMultiProviderJson(process.env.GH_AW_COPILOT_SDK_MULTI_PROVIDER_JSON);
+  const multiProviderConfig = parseMultiProviderJson(readSecretEnv("GH_AW_COPILOT_SDK_MULTI_PROVIDER_JSON"));
   if (!multiProviderConfig) {
     process.stderr.write("[copilot-sdk-driver] error: GH_AW_COPILOT_SDK_MULTI_PROVIDER_JSON is not set or invalid — " + "ensure the harness resolved multi-provider config from awf-reflect data\n");
     process.exit(1);

actions/setup/js/create_agent_session.cjs

@@ -6,6 +6,7 @@ const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_help
 const { getBaseBranch } = require("./get_base_branch.cjs");
 const { isStagedMode } = require("./safe_output_helpers.cjs");
 const { generateStagedPreview } = require("./staged_preview.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 /**
  * Module-level state — populated by handleMessage(), read by the exported getters below.
@@ -28,7 +29,7 @@ let _allResults = [];
  * @returns {Promise<Object>} Authenticated GitHub client
  */
 async function createAgentSessionGitHubClient(config) {
-  const token = config["github-token"] || process.env.GH_AW_AGENT_SESSION_TOKEN;
+  const token = config["github-token"] || readSecretEnv("GH_AW_AGENT_SESSION_TOKEN");
   if (!token) {
     core.debug("No dedicated agent token configured — using step-level github client for create-agent-session operations");
     return github;

actions/setup/js/create_issue.cjs

@@ -30,6 +30,7 @@ const { MAX_LABELS, MAX_ASSIGNEES } = require("./constants.cjs");
 const { findAgent, getIssueDetails, assignAgentToIssue } = require("./assign_agent_helpers.cjs");
 const { parseDeduplicateByTitle, normalizeTitleForDedup, findDuplicateByTitle } = require("./issue_title_dedup.cjs");
 const { resolveAllowedMentionsFromPayload } = require("./resolve_mentions_from_payload.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 const ISSUE_FIELD_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 const RECENTLY_CLOSED_DEDUP_DAYS = 30;
@@ -49,7 +50,7 @@ const TITLE_DEDUP_MIN_SEARCH_RATE_LIMIT_FRACTION = 0.2;
  * @returns {Promise<Object>} Authenticated GitHub client
  */
 async function createCopilotAssignmentClient(config) {
-  const token = config["github-token"] || process.env.GH_AW_ASSIGN_TO_AGENT_TOKEN;
+  const token = config["github-token"] || readSecretEnv("GH_AW_ASSIGN_TO_AGENT_TOKEN");
   if (!token) {
     core.debug("No dedicated agent token configured — using step-level github client for copilot assignment");
     return github;

actions/setup/js/create_pull_request.cjs

@@ -35,6 +35,7 @@ const { COPILOT_REVIEWER_BOT, FAQ_CREATE_PR_PERMISSIONS_URL } = require("./const
 const { isStagedMode } = require("./safe_output_helpers.cjs");
 const { normalizeCommitSHA } = require("./commit_sha_helpers.cjs");
 const { withRetry, RATE_LIMIT_RETRY_CONFIG } = require("./error_recovery.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 const { findAgent, getIssueDetails, assignAgentToIssue } = require("./assign_agent_helpers.cjs");
 const { ensureFullHistoryForBundle, extractBundlePrerequisiteCommits, getBundlePrerequisites, isShallowOrSparseCheckout, linearizeRangeAsCommit } = require("./git_helpers.cjs");
 const { parseDiffGitHeader: parseDiffGitHeaderPaths, extractDiffGitHeaderEntries } = require("./patch_path_helpers.cjs");
@@ -78,7 +79,7 @@ const {
  * @returns {Promise<Object>} Authenticated GitHub client
  */
 async function createCopilotAssignmentClient(config) {
-  const token = config["github-token"] || process.env.GH_AW_ASSIGN_TO_AGENT_TOKEN;
+  const token = config["github-token"] || readSecretEnv("GH_AW_ASSIGN_TO_AGENT_TOKEN");
   if (!token) {
     core.debug("No dedicated agent token configured — using step-level github client for copilot assignment");
     return github;
@@ -935,7 +936,7 @@ async function main(config = {}) {
 
   // Create checkout manager for multi-repo support (fallback when no checkout_mapping)
   // Token is available via GITHUB_TOKEN environment variable (set by the workflow job)
-  const checkoutToken = process.env.GITHUB_TOKEN;
+  const checkoutToken = readSecretEnv("GITHUB_TOKEN");
   const checkoutManager = checkoutToken ? createCheckoutManager(checkoutToken, { defaultBaseBranch: configBaseBranch }) : null;
 
   // Log multi-repo support status

actions/setup/js/extra_empty_commit.cjs

@@ -4,6 +4,7 @@
 const { validateTargetRepo, parseAllowedRepos, getDefaultTargetRepo } = require("./repo_helpers.cjs");
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { overridePersistedExtraheader, restorePersistedExtraheader } = require("./git_auth_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 /**
  * @fileoverview Extra Empty Commit Helper
@@ -55,7 +56,7 @@ function isCrossRepoTarget(repoOwner, repoName) {
  * @returns {Promise<{success: boolean, skipped?: boolean, error?: string}>}
  */
 async function pushExtraEmptyCommit({ branchName, repoOwner, repoName, commitMessage, newCommitCount, allowedRepos: allowedReposInput }) {
-  const token = process.env.GH_AW_CI_TRIGGER_TOKEN;
+  const token = readSecretEnv("GH_AW_CI_TRIGGER_TOKEN");
 
   if (!token || !token.trim()) {
     core.info("No extra empty commit token configured - skipping");

actions/setup/js/git_helpers.cjs

@@ -5,6 +5,7 @@ const { spawnSync } = require("child_process");
 const { ERR_SYSTEM } = require("./error_codes.cjs");
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { isTransientError } = require("./error_recovery.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 /**
  * Build GIT_CONFIG_* environment variables that inject an Authorization header
@@ -24,7 +25,7 @@ const { isTransientError } = require("./error_recovery.cjs");
  *   Returns an empty object when no token is available.
  */
 function getGitAuthEnv(token) {
-  const authToken = token || process.env.GITHUB_TOKEN;
+  const authToken = token || readSecretEnv("GITHUB_TOKEN");
   if (!authToken) {
     core.debug("getGitAuthEnv: no token available, git network operations may fail if credentials were cleaned");
     return {};

actions/setup/js/mount_mcp_as_cli.cjs

@@ -27,6 +27,7 @@ const http = require("http");
 const path = require("path");
 const { getErrorMessage } = require("./error_helpers.cjs");
 const { renderSafeOutputsPromptDocs } = require("./mcp_cli_schema_docs.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 const MANIFEST_FILE = path.join(process.env.RUNNER_TEMP || "/home/runner/work/_temp", "gh-aw/mcp-cli/manifest.json");
 // Use RUNNER_TEMP so the bin and tools directories are inside the AWF sandbox mount
@@ -555,7 +556,7 @@ async function main() {
     core.info(`Bridge script: ${bridgeScript}`);
   }
 
-  const apiKey = process.env.MCP_GATEWAY_API_KEY || "";
+  const apiKey = readSecretEnv("MCP_GATEWAY_API_KEY") || "";
   if (!apiKey) {
     core.warning("MCP_GATEWAY_API_KEY is not set; generated CLI wrappers will not be able to authenticate with the gateway");
   }

actions/setup/js/pi_agent_core_driver.cjs

@@ -40,6 +40,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
 const fs = require("fs");
 const path = require("path");
 const crypto = require("crypto");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 // ---------------------------------------------------------------------------
 // Logging helpers
@@ -140,7 +141,7 @@ function buildGetApiKey(gatewayConfig) {
       // holds the secret (Pi CLI's resolveConfigValue() semantics).
       const envVarName = gatewayConfig.apiKey;
       if (envVarName) {
-        const value = process.env[envVarName];
+        const value = readSecretEnv(envVarName);
         if (value) return value;
       }
     }
@@ -149,12 +150,12 @@ function buildGetApiKey(gatewayConfig) {
     switch (provider) {
       case "github-copilot":
       case "copilot":
-        return process.env.COPILOT_GITHUB_TOKEN || process.env.GITHUB_TOKEN;
+        return readSecretEnv("COPILOT_GITHUB_TOKEN") || readSecretEnv("GITHUB_TOKEN");
       case "anthropic":
-        return process.env.ANTHROPIC_API_KEY;
+        return readSecretEnv("ANTHROPIC_API_KEY");
       case "openai":
       case "codex":
-        return process.env.CODEX_API_KEY || process.env.OPENAI_API_KEY;
+        return readSecretEnv("CODEX_API_KEY") || readSecretEnv("OPENAI_API_KEY");
       default:
         return undefined;
     }

actions/setup/js/pi_provider.cjs

@@ -31,6 +31,7 @@ const { fetchAWFReflect, AWF_API_PROXY_REFLECT_URL, AWF_REFLECT_OUTPUT_PATH, AWF
 const fs = require("fs");
 const path = require("path");
 const { getErrorMessage } = require("./error_helpers.cjs");
+const { readSecretEnv } = require("./read_secret_env.cjs");
 
 // Default logger: prefixed with "[gh-aw/pi-provider]" for easy grepping.
 // prettier-ignore
@@ -241,7 +242,7 @@ function registerProviderAliases(pi, names, config, logger) {
 function registerConfiguredProviders(pi, logger) {
   let registeredCount = 0;
 
-  const copilotToken = process.env.COPILOT_GITHUB_TOKEN || process.env.GITHUB_TOKEN;
+  const copilotToken = readSecretEnv("COPILOT_GITHUB_TOKEN") || readSecretEnv("GITHUB_TOKEN");
   if (copilotToken) {
     registerProviderAliases(
       pi,
@@ -256,12 +257,13 @@ function registerConfiguredProviders(pi, logger) {
     registeredCount += 2;
   }
 
-  if (process.env.ANTHROPIC_API_KEY) {
+  const anthropicApiKey = readSecretEnv("ANTHROPIC_API_KEY");
+  if (anthropicApiKey) {
     registerProviderAliases(
       pi,
       ["anthropic"],
       {
-        apiKey: process.env.ANTHROPIC_API_KEY,
+        apiKey: anthropicApiKey,
         api: "anthropic",
         ...(process.env.ANTHROPIC_BASE_URL ? { baseUrl: process.env.ANTHROPIC_BASE_URL } : {}),
       },
@@ -270,7 +272,7 @@ function registerConfiguredProviders(pi, logger) {
     registeredCount += 1;
   }
 
-  const openAIKey = process.env.CODEX_API_KEY || process.env.OPENAI_API_KEY;
+  const openAIKey = readSecretEnv("CODEX_API_KEY") || readSecretEnv("OPENAI_API_KEY");
   if (openAIKey) {
     registerProviderAliases(
       pi,