mask temporary signing keychain password

.github/workflows/custom-release.yml

@@ -56,6 +56,7 @@ jobs:
           certificate_path="$RUNNER_TEMP/developer-id-application.p12"
           previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)"
 
+          echo "::add-mask::$keychain_password"
           echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_CERTIFICATE_PATH=$certificate_path" >> "$GITHUB_ENV"

scripts/tests/test-custom-release-macos-runner.bats

@@ -47,6 +47,9 @@ setup() {
 	run rg -n 'security import .* -P "\$DEVELOPER_ID_APPLICATION_P12_PASSWORD"' "$GITHUB_WORKFLOW"
 	[ "$status" -eq 0 ]
 
+	run rg -n '::add-mask::\$keychain_password' "$GITHUB_WORKFLOW"
+	[ "$status" -eq 0 ]
+
 	run rg -n 'if: always\(\)' "$GITHUB_WORKFLOW"
 	[ "$status" -eq 0 ]