Environment variables are displayed as clear-text

[Robbie Page]

When running this action the Lambda function environment variables are displayed clear-text in the build output. Is there a flag or option to suppress that output?

Thanks! Your code works like a charm otherwise!

[Paul Allen]

Second @rorpage , Love the action....but can not use this anywhere if env vars are being logged.

[Bo-Yi Wu]

I will take it.

[Bo-Yi Wu]

@ptallen63 Do you have any screenshots?

[Adrian Godong]

Can verify this is happening. Here's an anonymized log from GHA:

##[command]/usr/bin/docker run --name e87b52daece746306b478d86dd660231940aa5_0747c0 ...
2020/03/31 05:22:05 {
  ...,
  Environment: {
    Variables: {
      AAA_BBB_CCC: "SECRET SECRET SECRET",
      DDD_EEE_FFF: "..."
    }
  },
  FunctionArn: "arn:aws:lambda:us-east-1:...",
  FunctionName: "...",
  Handler: "...",
  ...
}

I'm not proficient in Go, but I believe this issue is caused by this line: https://github.com/appleboy/drone-lambda/blob/master/plugin.go#L137

Given that Actions log file for public repos are public and it is common to store runtime secrets in env var, I believe this is an urgent security issue.

[Bo-Yi Wu]

@adriangodong I will move the log message in debug mode.

[Bo-Yi Wu]

bump to v0.0.3 https://github.com/appleboy/lambda-action/releases/tag/v0.0.3

[Adrian Godong]

Confirmed 0.0.3 works! Thank you, much appreciated!