From 8a34a6373a9761a3bac8df82f3a9375bfb3b6cb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felix=20F=C3=B6rtsch?= Date: Wed, 12 Aug 2026 12:24:33 +0200 Subject: [PATCH] mask temporary signing keychain password --- .github/workflows/custom-release.yml | 1 + scripts/tests/test-custom-release-macos-runner.bats | 3 +++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/custom-release.yml b/.github/workflows/custom-release.yml index bb12cd21e..e9e3f7208 100644 --- a/.github/workflows/custom-release.yml +++ b/.github/workflows/custom-release.yml @@ -56,6 +56,7 @@ jobs: certificate_path="$RUNNER_TEMP/developer-id-application.p12" previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)" + echo "::add-mask::$keychain_password" echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV" echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV" echo "CUSTOM_RELEASE_CERTIFICATE_PATH=$certificate_path" >> "$GITHUB_ENV" diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats index f186219ae..4d5156daf 100644 --- a/scripts/tests/test-custom-release-macos-runner.bats +++ b/scripts/tests/test-custom-release-macos-runner.bats @@ -47,6 +47,9 @@ setup() { run rg -n 'security import .* -P "\$DEVELOPER_ID_APPLICATION_P12_PASSWORD"' "$GITHUB_WORKFLOW" [ "$status" -eq 0 ] + run rg -n '::add-mask::\$keychain_password' "$GITHUB_WORKFLOW" + [ "$status" -eq 0 ] + run rg -n 'if: always\(\)' "$GITHUB_WORKFLOW" [ "$status" -eq 0 ]