Ability to redact secret values (if any) in the comment

[kishaningithub]

Would be great if this can redact all github secrets if they appear in the comment.

Find and replace solves this to an extent but i want it to cover all secrets with a flag like

redact-secrets: true

[guibranco]

@mshick could you please assign this to me? I would like to work on this one!

[umudhasanli]

One GitHub limitation to account for: an Action cannot enumerate every repository secret value, so no library can guarantee matching all secrets unless the workflow explicitly passes the values that need exact masking.

A useful two-layer implementation is:

import { redact } from "flare-redact";

const safeComment = redact(commentBody, {
  terms: explicitlyPassedSecretValues,
});

The built-in detectors catch known token/key formats, PEM blocks, credentials in URLs, and secret assignments. terms then exactly masks any opaque values the caller deliberately supplies through environment inputs. Those values should never be CLI arguments or debug output.

This would make redact-secrets: true useful while documenting the honest boundary: format detection is automatic; arbitrary secret values require explicit input.

Maintainer disclosure: I maintain Flare Redact.