Added warning to documentation.

[tobias-wilfert]

These strings leaking has been a known issue since at least 5 years (See github issue: https://github.com/actions/runner/issues/475) regardless of whether or not this will ever be fixed the least that can be done is give the user a heads up that these 2 use cases will not mask the values. (Removing the 2 sections in their entirety might also be an option 🤔).

Why:

Closes: github issue: https://github.com/actions/runner/issues/475

What's being changed (if available, include any code snippets, screenshots, or gifs):

Merly adding two warnings to two sections giving the user a heads up that these "masks" will still leak the string that should be masked.

Check off the following:

• [ ] A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• [ ] The changes in this PR meet the docs fundamentals that are required for all content.
• [ ] All CI checks are passing and the changes look good in the review environment.

[welcome[bot]]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[github-actions[bot]]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

⚠️ Warning: Our review server is experiencing latency issues.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on the review server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions.md	fpt ghec ghes@ 3.16 3.15 3.14 3.13 3.12	fpt ghec ghes@ 3.16 3.15 3.14 3.13 3.12

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[jsoref]

I don't think this is precisely the right fix, but I do agree the example is wrong. I'd be inclined to suggest an example closer to: https://github.com/actions/runner/issues/475#issuecomment-2786734511

(I don't expect to have any time to do anything like this before the end of the month.)

[Sharra-writes]

@tobias-wilfert Thanks for opening a PR! Since this is still a draft, could you ping me when this is ready to make sure I don't overlook it? ✨

[github-actions[bot]]

A stale label has been added to this pull request because it has been open 30 days with no activity. If you think this pull request should remain open, please add a new comment.

[Sharra-writes]

@tobias-wilfert I reopened this PR in case you were still intending to work on it. Is this something that's going to take a while? Would it benefit from a never-stale label?

[cceneag]

###Ok

[github-actions[bot]]

A stale label has been added to this pull request because it has been open 30 days with no activity. If you think this pull request should remain open, please add a new comment.

[Besho777]

12091998

---------- Forwarded message --------- De: github-actions[bot] @.> Date: lun, 14 de jul de 2025, 10:32 a. m. Subject: Re: [github/docs] Added warning to documentation. (PR #37411) To: github/docs @.> Cc: Subscribed @.***>

Closed #37411 https://github.com/github/docs/pull/37411.

— Reply to this email directly, view it on GitHub https://github.com/github/docs/pull/37411#event-18621584277, or unsubscribe https://github.com/notifications/unsubscribe-auth/BL64SJFGKQBRRN4UB3MWRPD3IPLRLAVCNFSM6AAAAAB2WJXCZ2VHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJYGYZDCNJYGQZDONY . You are receiving this because you are subscribed to this thread.Message ID: @.***>

[Croydon]

It is beyond me that GitHub risks that people leak secrets by using this mess of a function - and does not even add a clear warning to the documentation.