From 89086c416317ccec6853caf3f24a8bc84ba3f4dd Mon Sep 17 00:00:00 2001
From: Claude <claude@megamileystudios.com>
Date: Thu, 6 Aug 2026 08:47:21 +0000
Subject: [PATCH] Fix private key leaking into step logs

Composite actions substitute ${{ inputs.* }} directly into the run:
script source before execution, and the runner echoes that resolved
script at the top of the step log. Interpolating private_key and
transfers straight into the heredocs meant the raw SSH private key
was printed in plaintext on every run. Move both through env: and
reference them as shell variables instead, matching ssh-checkout and
ssh-command.
---
 action.yml | 42 ++++++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/action.yml b/action.yml
index cd88c90..d578944 100644
--- a/action.yml
+++ b/action.yml
@@ -25,48 +25,50 @@ runs:
   steps:
     - name: Execute SSH/SCP Transfers
       shell: bash
+      env:
+        PRIVATE_KEY: ${{ inputs.private_key }}
+        TRANSFERS: ${{ inputs.transfers }}
+        HOST: ${{ inputs.host }}
+        PORT: ${{ inputs.port }}
+        USERNAME: ${{ inputs.username }}
       run: |
         # 1. Create a secure temporary file for the SSH key
         SSH_KEY_PATH=$(mktemp)
-        cat << 'EOF' > "$SSH_KEY_PATH"
-        ${{ inputs.private_key }}
-        EOF
+        printf '%s\n' "$PRIVATE_KEY" > "$SSH_KEY_PATH"
         chmod 600 "$SSH_KEY_PATH"
-        
+
         # 2. Add Host to known_hosts to prevent verification prompts
         mkdir -p ~/.ssh
-        ssh-keyscan -p ${{ inputs.port }} -H ${{ inputs.host }} >> ~/.ssh/known_hosts 2>/dev/null
-        
+        ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
         # 3. Securely write transfers input to a file for parsing
-        cat << 'EOF' > transfers.txt
-        ${{ inputs.transfers }}
-        EOF
-        
+        printf '%s\n' "$TRANSFERS" > transfers.txt
+
         # 4. Loop through each line and execute commands
         while IFS= read -r line || [ -n "$line" ]; do
           # Skip empty lines
           [[ -z "$(echo "$line" | tr -d '[:space:]')" ]] && continue
-          
+
           # Parse using the pipe | delimiter
           IFS='|' read -r src dest <<< "$line"
-          
+
           # Trim leading and trailing whitespace
           src=$(echo "$src" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
           dest=$(echo "$dest" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-          
+
           if [ -n "$src" ] && [ -n "$dest" ]; then
             echo "::group::Transfer to $dest"
-            
+
             echo "Creating remote directory: $dest"
-            ssh -i "$SSH_KEY_PATH" -p ${{ inputs.port }} ${{ inputs.username }}@${{ inputs.host }} "mkdir -p \"$dest\"" < /dev/null
-            
+            ssh -i "$SSH_KEY_PATH" -p "$PORT" "$USERNAME@$HOST" "mkdir -p \"$dest\"" < /dev/null
+
             echo "Copying $src to $dest..."
             # Note: eval is used so wildcards or multiple space-separated files expand properly
-            eval "scp -r -i \"$SSH_KEY_PATH\" -P ${{ inputs.port }} $src \"${{ inputs.username }}@${{ inputs.host }}:$dest/\"" < /dev/null
-            
+            eval "scp -r -i \"$SSH_KEY_PATH\" -P $PORT $src \"$USERNAME@$HOST:$dest/\"" < /dev/null
+
             echo "::endgroup::"
           fi
         done < transfers.txt
-        
+
         # 5. Cleanup
-        rm -f "$SSH_KEY_PATH" transfers.txt
\ No newline at end of file
+        rm -f "$SSH_KEY_PATH" transfers.txt