private_key and transfers were interpolated directly into the run: script text via heredoc (${{ inputs.private_key }}), instead of being passed through env:.
Composite actions substitute ${{ }} expressions into the script before execution, and the Actions runner echoes that resolved script at the top of the step log. This meant the raw SSH private key was printed in plaintext in the job log on every single run of this action, regardless of success or failure.
Fix
Move private_key, transfers, host, port, and username into an env: block and reference them as shell variables ($PRIVATE_KEY, $TRANSFERS, etc.) instead of interpolating the ${{ inputs.* }} expressions directly into the script body. This matches the pattern already used correctly in ssh-checkout and ssh-command.
Behavior is otherwise unchanged.
Action required
Any private key previously passed to this action should be treated as compromised and rotated, since it was being printed to logs.
## Problem
`private_key` and `transfers` were interpolated directly into the `run:` script text via heredoc (`${{ inputs.private_key }}`), instead of being passed through `env:`.
Composite actions substitute `${{ }}` expressions into the script *before* execution, and the Actions runner echoes that resolved script at the top of the step log. This meant the raw SSH private key was printed in plaintext in the job log on every single run of this action, regardless of success or failure.
## Fix
Move `private_key`, `transfers`, `host`, `port`, and `username` into an `env:` block and reference them as shell variables (`$PRIVATE_KEY`, `$TRANSFERS`, etc.) instead of interpolating the `${{ inputs.* }}` expressions directly into the script body. This matches the pattern already used correctly in `ssh-checkout` and `ssh-command`.
Behavior is otherwise unchanged.
## Action required
Any private key previously passed to this action should be treated as compromised and rotated, since it was being printed to logs.
Composite actions substitute ${{ inputs.* }} directly into the run:
script source before execution, and the runner echoes that resolved
script at the top of the step log. Interpolating private_key and
transfers straight into the heredocs meant the raw SSH private key
was printed in plaintext on every run. Move both through env: and
reference them as shell variables instead, matching ssh-checkout and
ssh-command.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
private_keyandtransferswere interpolated directly into therun:script text via heredoc (${{ inputs.private_key }}), instead of being passed throughenv:.Composite actions substitute
${{ }}expressions into the script before execution, and the Actions runner echoes that resolved script at the top of the step log. This meant the raw SSH private key was printed in plaintext in the job log on every single run of this action, regardless of success or failure.Fix
Move
private_key,transfers,host,port, andusernameinto anenv:block and reference them as shell variables ($PRIVATE_KEY,$TRANSFERS, etc.) instead of interpolating the${{ inputs.* }}expressions directly into the script body. This matches the pattern already used correctly inssh-checkoutandssh-command.Behavior is otherwise unchanged.
Action required
Any private key previously passed to this action should be treated as compromised and rotated, since it was being printed to logs.
Composite actions substitute ${{ inputs.* }} directly into the run: script source before execution, and the runner echoes that resolved script at the top of the step log. Interpolating private_key and transfers straight into the heredocs meant the raw SSH private key was printed in plaintext on every run. Move both through env: and reference them as shell variables instead, matching ssh-checkout and ssh-command.