Merge pull request 'Fix SSH private key leaking into step logs' (#1) from fix/env-var-secret-leak into main

Reviewed-on: #1

action.yml

@@ -25,48 +25,50 @@ runs:
   steps:
     - name: Execute SSH/SCP Transfers
       shell: bash
+      env:
+        PRIVATE_KEY: ${{ inputs.private_key }}
+        TRANSFERS: ${{ inputs.transfers }}
+        HOST: ${{ inputs.host }}
+        PORT: ${{ inputs.port }}
+        USERNAME: ${{ inputs.username }}
       run: |
         # 1. Create a secure temporary file for the SSH key
         SSH_KEY_PATH=$(mktemp)
-        cat << 'EOF' > "$SSH_KEY_PATH"
+        printf '%s\n' "$PRIVATE_KEY" > "$SSH_KEY_PATH"
-        ${{ inputs.private_key }}
-        EOF
         chmod 600 "$SSH_KEY_PATH"
-        
+
         # 2. Add Host to known_hosts to prevent verification prompts
         mkdir -p ~/.ssh
-        ssh-keyscan -p ${{ inputs.port }} -H ${{ inputs.host }} >> ~/.ssh/known_hosts 2>/dev/null
+        ssh-keyscan -p "$PORT" -H "$HOST" >> ~/.ssh/known_hosts 2>/dev/null
-        
+
         # 3. Securely write transfers input to a file for parsing
-        cat << 'EOF' > transfers.txt
+        printf '%s\n' "$TRANSFERS" > transfers.txt
-        ${{ inputs.transfers }}
+
-        EOF
-        
         # 4. Loop through each line and execute commands
         while IFS= read -r line || [ -n "$line" ]; do
           # Skip empty lines
           [[ -z "$(echo "$line" | tr -d '[:space:]')" ]] && continue
-          
+
           # Parse using the pipe | delimiter
           IFS='|' read -r src dest <<< "$line"
-          
+
           # Trim leading and trailing whitespace
           src=$(echo "$src" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
           dest=$(echo "$dest" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
-          
+
           if [ -n "$src" ] && [ -n "$dest" ]; then
             echo "::group::Transfer to $dest"
-            
+
             echo "Creating remote directory: $dest"
-            ssh -i "$SSH_KEY_PATH" -p ${{ inputs.port }} ${{ inputs.username }}@${{ inputs.host }} "mkdir -p \"$dest\"" < /dev/null
+            ssh -i "$SSH_KEY_PATH" -p "$PORT" "$USERNAME@$HOST" "mkdir -p \"$dest\"" < /dev/null
-            
+
             echo "Copying $src to $dest..."
             # Note: eval is used so wildcards or multiple space-separated files expand properly
-            eval "scp -r -i \"$SSH_KEY_PATH\" -P ${{ inputs.port }} $src \"${{ inputs.username }}@${{ inputs.host }}:$dest/\"" < /dev/null
+            eval "scp -r -i \"$SSH_KEY_PATH\" -P $PORT $src \"$USERNAME@$HOST:$dest/\"" < /dev/null
-            
+
             echo "::endgroup::"
           fi
         done < transfers.txt
-        
+
         # 5. Cleanup
-        rm -f "$SSH_KEY_PATH" transfers.txt
+        rm -f "$SSH_KEY_PATH" transfers.txt