ci: mask user input

emqx · Jul 22, 2024 · 35c1250 · 35c1250
1 parent cab3931
commit 35c1250
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/.github/workflows/run.yaml b/.github/workflows/run.yaml
@@ -25,12 +25,17 @@ jobs:
 
     steps:
     - name: Configure AWS Credentials
+      env:
+        AWS_ACCESS_KEY_ID: ${{ github.event.inputs.aws_access_key }}
+        AWS_SECRET_ACCESS_KEY: ${{ github.event.inputs.aws_secret_access_key }}
       run: |
+        echo "::add-mask::$AWS_ACCESS_KEY_ID"
+        echo "::add-mask::$AWS_SECRET_ACCESS_KEY"
         mkdir -p ~/.aws
         cat <<EOF > ~/.aws/credentials
         [default]
-        aws_access_key_id = ${{ github.event.inputs.aws_access_key }}
-        aws_secret_access_key = ${{ github.event.inputs.aws_secret_access_key }}
+        aws_access_key_id = $AWS_ACCESS_KEY_ID
+        aws_secret_access_key = $AWS_SECRET_ACCESS_KEY
         EOF
 
         cat <<EOF > ~/.aws/config
@@ -74,7 +79,7 @@ jobs:
     - name: terraform destroy
       if: always()
       run: |
-        terraform destroy -var spec_file=tests/${{ github.event.inputs.scenario }}.yaml -auto-approve 
+        terraform destroy -var spec_file=tests/${{ github.event.inputs.scenario }}.yaml -auto-approve -lock=false
     - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
       if: failure()
       with: