Skip to content

Commit 746c946

Browse files
MariusStorhaugMariusStorhaug
authored
🌟 [Major]: Fix path separator in action.yml and update README.md (#10)
## Description This pull request includes several changes to improve the handling of sensitive information, enhance the readability of the debug information, and update documentation, including adding a new function to mask sensitive values, updating the `README.md` to provide clearer information about the action, and modifying the PowerShell script to use the new masking function. Enhancements to sensitive information handling: * `action.yml`: * Fixed the path separator in the script path to ensure compatibility across different environments. * `scripts/Helpers.psm1`: * Added a new `Set-MaskedValue` function to mask sensitive values such as GitHub tokens, JWT tokens, and private keys. * `scripts/main.ps1`: * Imported the `Helpers.psm1` module and set the output rendering to ANSI for better readability. * Updated various logging sections to use the `Set-MaskedValue` function to mask sensitive information in environment variables and PowerShell variables. Documentation updates: * `README.md`: * Updated the documentation to provide more comprehensive information about the action, including inputs, outputs, and a caution about exposing sensitive information. Tests: * `.github/workflows/Action-Test.yml`: * Added an environment variable for a fake private key for debugging purposes. ## Type of change <!-- Use the check-boxes [x] on the options that are relevant. --> - [ ] 📖 [Docs] - [ ] 🪲 [Fix] - [ ] 🩹 [Patch] - [ ] ⚠️ [Security fix] - [ ] 🚀 [Feature] - [x] 🌟 [Breaking change] ## Checklist <!-- Use the check-boxes [x] on the options that are relevant. --> - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas
1 parent ede86e5 commit 746c946

5 files changed

Lines changed: 168 additions & 21 deletions

File tree

‎.github/workflows/Action-Test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ permissions:
1616
contents: read
1717
pull-requests: read
1818

19+
env:
20+
PSMODULE_DEBUG_FAKE_PRIVATE_KEY: ${{ secrets.FAKE_PRIVATE_KEY }}
21+
1922
jobs:
2023
ActionTestBasic:
2124
strategy:

‎README.md‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,27 @@
1-
# Debug
1+
# Debug Action
22

3-
Gets debug information about the environment.
3+
Prints comprehensive debug information about the GitHub Actions runner environment, contexts, environment variables, and PowerShell state.
44

5-
Uses all the contexts, environment variables and PowerShell variables and modules.
6-
7-
- [Contexts | GitHub Docs](https://docs.github.com/en/actions/learn-github-actions/contexts)
8-
- [Variables | GitHub Docs](https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables)
5+
> [!CAUTION]
6+
> This action exposes environment variables and contexts, which may include sensitive information or secrets. GitHub attempts to mask
7+
> secrets in logs, but if a secret contains newlines (common with private keys) due to PowerShell's formatting, GitHub masking may fail and
8+
> inadvertently expose the secret.
99
1010
## Usage
1111

12-
### Example
12+
### Inputs
13+
14+
This action does not currently require any inputs.
15+
16+
### Secrets
17+
18+
This action does not explicitly require secrets but may display environment variables or contexts containing sensitive information. Use with caution.
1319

14-
#### Example 1: Get debug information
20+
### Outputs
21+
22+
This action does not provide outputs.
23+
24+
## Example
1525

1626
```yaml
1727
jobs:
@@ -21,3 +31,17 @@ jobs:
2131
- name: Debug
2232
uses: PSModule/Debug@v1
2333
```
34+
35+
## Information Displayed
36+
37+
- [GitHub Context](https://docs.github.com/en/actions/learn-github-actions/contexts)
38+
- [Environment Variables](https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables)
39+
- GitHub event payload details
40+
- PowerShell environment details including:
41+
- Variables
42+
- Installed Modules
43+
- Execution context
44+
- Host details
45+
- Invocation details
46+
- PowerShell session options
47+
- PowerShell version details

‎action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,4 @@ runs:
2929
Verbose: true
3030
Script: |
3131
# Debug environment
32-
${{ github.action_path }}\scripts\main.ps1
32+
${{ github.action_path }}/scripts/main.ps1

‎scripts/Helpers.psm1‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
filter Set-MaskedValue {
2+
<#
3+
.SYNOPSIS
4+
Masks sensitive values such as GitHub tokens, JWT tokens, and private keys.
5+
6+
.DESCRIPTION
7+
This function checks an input string against known patterns for sensitive values, such as:
8+
- GitHub tokens (Personal Access Tokens, OAuth Tokens, Session Tokens, User Tokens)
9+
- JSON Web Tokens (JWT)
10+
- Private keys
11+
If a match is found, the function replaces the value with a corresponding masked placeholder.
12+
If no match is found, the original value is returned unaltered.
13+
14+
.EXAMPLE
15+
Set-MaskedValue -Value 'github_pat_1234567890123456789012'
16+
17+
Output:
18+
```powershell
19+
***GITHUB_FG_PAT_TOKEN***
20+
```
21+
22+
Masks a GitHub fine-grained personal access token.
23+
24+
.EXAMPLE
25+
Set-MaskedValue -Value 'ghp_abcdefghijklmnopqrstuvwxyz0123456789' #gitleaks:allow
26+
27+
Output:
28+
```powershell
29+
***GITHUB_CLASSIC_PAT_TOKEN***
30+
```
31+
32+
Masks a classic GitHub personal access token.
33+
34+
.EXAMPLE
35+
Set-MaskedValue -Value 'header.payload.signature'
36+
37+
Output:
38+
```powershell
39+
***JWT_TOKEN***
40+
```
41+
42+
Masks a JSON Web Token (JWT).
43+
44+
.EXAMPLE
45+
Set-MaskedValue -Value "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAA..."
46+
47+
Output:
48+
```powershell
49+
***PRIVATE_KEY***
50+
```
51+
52+
Masks a private key.
53+
54+
.OUTPUTS
55+
string
56+
57+
.NOTES
58+
Returns the masked value if a match is found; otherwise, returns the original value.
59+
#>
60+
[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
61+
'PSUseShouldProcessForStateChangingFunctions', '',
62+
Justification = 'This function is not state-changing. It is a utility function.'
63+
)]
64+
[OutputType([string])]
65+
[CmdletBinding()]
66+
param (
67+
# The value to be checked and potentially masked.
68+
[Parameter(ValueFromPipeline)]
69+
[string] $Value = ''
70+
)
71+
72+
switch -Regex ($Value) {
73+
'^github_pat_' {
74+
'***GITHUB_FG_PAT_TOKEN***'
75+
break
76+
}
77+
'^ghp_' {
78+
'***GITHUB_CLASSIC_PAT_TOKEN***'
79+
break
80+
}
81+
'^ghs_' {
82+
'***GITHUB_SESSION_TOKEN***'
83+
break
84+
}
85+
'^ghu_' {
86+
'***GITHUB_USER_TOKEN***'
87+
break
88+
}
89+
'^gho_' {
90+
'***GITHUB_OAUTH_TOKEN***'
91+
break
92+
}
93+
'^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$' {
94+
'***JWT_TOKEN***'
95+
break
96+
}
97+
'PRIVATE KEY.*[\s\S]+?.*PRIVATE KEY' {
98+
'***PRIVATE_KEY***'
99+
break
100+
}
101+
default {
102+
$Value
103+
}
104+
}
105+
}

‎scripts/main.ps1‎

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
[CmdletBinding()]
22
param()
33

4+
$PSStyle.OutputRendering = 'Ansi'
5+
Import-Module "$PSScriptRoot/Helpers.psm1"
6+
47
$CONTEXT_GITHUB = $env:CONTEXT_GITHUB | ConvertFrom-Json -Depth 100
58

69
LogGroup 'Context: [GITHUB]' {
@@ -71,7 +74,13 @@ LogGroup "File system at [$pwd]" {
7174
}
7275

7376
LogGroup 'Environment Variables' {
74-
Get-ChildItem env: | Where-Object { $_.Name -notlike 'CONTEXT_*' } | Sort-Object Name | Format-Table -AutoSize -Wrap
77+
$vars = [ordered]@{}
78+
Get-ChildItem env: | Where-Object { $_.Name -notlike 'CONTEXT_*' } | Sort-Object Name | ForEach-Object {
79+
$name = $_.Name
80+
$value = $_.Value | Set-MaskedValue
81+
$vars.Add($name, $value)
82+
}
83+
[pscustomobject]$vars | Format-List | Out-String
7584
}
7685

7786
LogGroup '[System.Environment]' {
@@ -84,49 +93,55 @@ LogGroup '[System.Environment]' {
8493
$props.GetEnumerator() | Sort-Object Name | ForEach-Object {
8594
$propsObject | Add-Member -MemberType NoteProperty -Name $_.Name -Value $_.Value
8695
}
87-
$propsObject | Format-List
96+
$propsObject | Format-List | Out-String
8897
}
8998

9099
LogGroup 'PowerShell variables' {
91-
Get-Variable | Where-Object { $_.Name -notlike 'CONTEXT_*' } | Sort-Object Name | Format-Table -AutoSize -Wrap
100+
$vars = [ordered]@{}
101+
Get-Variable | Where-Object { $_.Name -notlike 'CONTEXT_*' } | Select-Object -Property Name, Value | Sort-Object Name | ForEach-Object {
102+
$name = $_.Name
103+
$value = $_.Value | Set-MaskedValue
104+
$vars.Add($name, $value)
105+
}
106+
[pscustomobject]$vars | Format-List | Out-String
92107
}
93108

94109
LogGroup 'PSVersionTable' {
95-
$PSVersionTable | Select-Object * | Format-List
110+
$PSVersionTable | Select-Object * | Format-List | Out-String
96111
}
97112

98113
LogGroup 'Installed Modules - List' {
99114
$modules = Get-PSResource | Sort-Object -Property Name
100-
$modules | Select-Object Name, Version, CompanyName, Author | Format-Table -AutoSize -Wrap
115+
$modules | Select-Object Name, Version, CompanyName, Author | Format-Table -AutoSize -Wrap | Out-String
101116
}
102117

103118
$modules.Name | Select-Object -Unique | ForEach-Object {
104119
$name = $_
105120
LogGroup "Installed Modules - Details - [$name]" {
106-
$modules | Where-Object Name -EQ $name | Select-Object * | Format-List
121+
$modules | Where-Object Name -EQ $name | Select-Object * | Format-List | Out-String
107122
}
108123
}
109124

110125
LogGroup 'ExecutionContext' {
111-
$ExecutionContext | Select-Object * | Format-List
126+
$ExecutionContext | ConvertTo-Json -Depth 3
112127
}
113128

114129
LogGroup 'Host' {
115-
$Host | Select-Object * | Format-List
130+
$Host | Select-Object * | Format-List | Out-String
116131
}
117132

118133
LogGroup 'MyInvocation' {
119-
$MyInvocation | Select-Object * | Format-List
134+
$MyInvocation | Select-Object * | Format-List | Out-String
120135
}
121136

122137
LogGroup 'PSCmdlet' {
123-
$PSCmdlet | Select-Object * | Format-List
138+
$PSCmdlet | Select-Object * | Format-List | Out-String
124139
}
125140

126141
LogGroup 'PSSessionOption' {
127-
$PSSessionOption | Select-Object * | Format-List
142+
$PSSessionOption | Select-Object * | Format-List | Out-String
128143
}
129144

130145
LogGroup 'PSStyle' {
131-
$PSStyle | Select-Object * | Format-List
146+
$PSStyle | Select-Object * | Format-List | Out-String
132147
}

0 commit comments

Comments
 (0)