Repository navigation
Conversation
The action never used it. Keep the input, now optional, so workflows that pass it don't get an "unexpected input" warning, and keep its args slot so the other args stay in place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Passing secrets in runs.args put them on the docker run command line, where other processes on the runner can read them; GitHub only masks them in the logs. The runner already gives the container every input as an INPUT_* env var, passed by name only, so read the token from there and leave the secrets' args slots empty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
seanogdev
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack: 1. #75 tests → 2. #76 bug fixes → 3. #77 link matching → 4. #78 secrets → 5. #79 test mode removal
Summary
A Docker action's
runs.argsend up on thedocker runcommand line, where other processes on the runner can read them; GitHub only masks them in the logs. The Teamwork token is now read from theINPUT_TEAMWORK_API_TOKENenv var the runner already passes by name, and the unusedGITHUB_TOKENbecomes an optional, deprecated input. Both of their args slots stay, empty, so the other inputs keep their positions.Evidence
docker run … "***" "localhost" "test_api_token" …: the GitHub token is on the command line, masked only in the log. The same command passes-e "INPUT_TEAMWORK_API_TOKEN"by name.After: the container's args are
["", "<uri>", "", "true", "PR Open", …], with the token only in its environment (checked withdocker inspect). All 22 cases pass with the third arg empty; they would all get a 401 if the token weren't read fromINPUT_TEAMWORK_API_TOKEN.🤖 Generated with Claude Code