Skip to content

Commit 2fa6ffe

Browse files
authored
bug(output): do not print output by default (#202)
It's possible to trick the LLM into printing sensitive information from the environment like access keys or credentials. While GitHub Actions secret masking + shell_command restrictions provide some protections, the best protection is to suppress Gemini CLI output in the logs. The output is still accessible via the `summary` and `error` fields on the GitHub Action, in case later steps do want to print or inspect the output.
1 parent f7e2b16 commit 2fa6ffe

File tree

1 file changed

+0
-10
lines changed

1 file changed

+0
-10
lines changed

action.yml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -167,23 +167,13 @@ runs:
167167
168168
GEMINI_RESPONSE="$(cat "${TEMP_STDOUT}")"
169169
170-
# Print the response
171-
echo "::group::Gemini response"
172-
echo "${GEMINI_RESPONSE}"
173-
echo "::endgroup::"
174-
175170
# Set the captured response as a step output, supporting multiline
176171
echo "gemini_response<<EOF" >> "${GITHUB_OUTPUT}"
177172
echo "${GEMINI_RESPONSE}" >> "${GITHUB_OUTPUT}"
178173
echo "EOF" >> "${GITHUB_OUTPUT}"
179174
180175
GEMINI_ERRORS="$(cat "${TEMP_STDERR}")"
181176
182-
# Print any errors
183-
echo "::group::Gemini error messages"
184-
echo "${GEMINI_ERRORS}"
185-
echo "::endgroup::"
186-
187177
# Set the captured errors as a step output, supporting multiline
188178
echo "gemini_errors<<EOF" >> "${GITHUB_OUTPUT}"
189179
echo "${GEMINI_ERRORS}" >> "${GITHUB_OUTPUT}"

0 commit comments

Comments
 (0)