From cfe48bcf19a9e2047ed4aedcfb7c775d5abd3e9f Mon Sep 17 00:00:00 2001
From: Gabor Demeter <demetergabor94@gmail.com>
Date: Thu, 20 Aug 2026 19:21:14 +0200
Subject: [PATCH] fix(gcp-secret-get): write multiline field values via
 GITHUB_ENV's heredoc form

The naive NAME=value append corrupts $GITHUB_ENV the moment a field's value
contains an embedded newline -- jwt_key is a multi-line PEM. Every field now
goes through the NAME<<DELIM / value / DELIM form with a random per-field
delimiter, and each non-empty line of a value is masked individually rather
than masking the whole multi-line blob as one token (log masking matches
per line).

Caught by the second real end-to-end run of sf-org-login's gcp branch: the
prior export_to_environment fix got past the empty-secret guard, but the
JWT login step then rejected the decoded key with "not a PEM private key" --
verified locally that this fix produces the exact documented GITHUB_ENV
multiline format before pushing.
---
 .github/actions/gcp-secret-get/action.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/actions/gcp-secret-get/action.yml b/.github/actions/gcp-secret-get/action.yml
index 4e386c8..73ff0cf 100644
--- a/.github/actions/gcp-secret-get/action.yml
+++ b/.github/actions/gcp-secret-get/action.yml
@@ -55,6 +55,10 @@ runs:
         # node rather than jq: node ships wherever the sf CLI runs, containers
         # included, so this works on images that carry no jq (matches the
         # convention in sf-org-login's "Resolve org identity" step).
+        # Every field is written using $GITHUB_ENV'\''s multiline heredoc form
+        # (NAME<<DELIM / value / DELIM), not bare NAME=value — a private key
+        # spans multiple lines, and the simple form corrupts $GITHUB_ENV the
+        # moment a value contains an embedded newline.
         node -e '
           const data = JSON.parse(process.env.SECRET_JSON || "{}");
           const keys = Object.keys(data);
@@ -63,10 +67,15 @@ runs:
             process.exit(1);
           }
           const fs = require("fs");
+          const crypto = require("crypto");
           const lines = [];
           for (const [key, value] of Object.entries(data)) {
-            console.log(`::add-mask::${value}`);
-            lines.push(`${key.toUpperCase()}=${value}`);
+            const stringValue = String(value);
+            for (const line of stringValue.split("\n")) {
+              if (line.length > 0) console.log(`::add-mask::${line}`);
+            }
+            const delimiter = `ghadelim_${crypto.randomBytes(16).toString("hex")}`;
+            lines.push(`${key.toUpperCase()}<<${delimiter}`, stringValue, delimiter);
           }
           fs.appendFileSync(process.env.GITHUB_ENV, lines.join("\n") + "\n");
         '