fix: github tokens are stored in plain variables and... in action.js

[anupamme]

Summary

Fix high severity security issue in action.js.

Vulnerability

Field	Value
ID	V-002
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-002
File	action.js:8
Assessment	Likely exploitable

Description: GitHub tokens are stored in plain variables and not masked in logs. When debug mode is enabled, error stack traces printed to console.error() may include token values. Error messages could also contain tokens if API errors include them in responses, exposing secrets to anyone with read access to Actions logs.

Evidence

Exploitation scenario: Attacker triggers the action with malicious input to cause an error, enables debug logging via ACTIONS_STEP_DEBUG secret, and extracts the token from the published stack trace in GitHub Actions logs.

Scanner confirmation: multi_agent_ai rule V-002 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• action.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[Copilot]

Pull request overview

This PR aims to mitigate a high-severity secret-exposure risk in the GitHub Action by masking the provided GitHub token so it won’t appear in logs/stack traces when debug logging is enabled.

Changes:

• Register the token input as a masked secret via @actions/core.setSecret.
• Refactor several info(...) log messages to use string concatenation instead of template literals.

Show a summary per file

File	Description
action.js	Masks the token input via setSecret(token) and adjusts log message construction.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite