Fix: Securely mask secrets in Reusable Workflows

[askb]

Problem:

This commit addresses the issue of secret exposure when passing secrets between reusable workflows in GitHub Actions. Automatic secret masking within reusable workflows is lost due to secret inheritance limitations. Additionally, multiline secrets and special characters pose challenges [1.] is undefined with Github actions.

Proposed Solution:

To redact and mask secrets from console logs, I propose the two-step Base64 encoding approach inspired by [2.]:

1. Double Base64 Encoding: Before storing secrets in the organization or repository secret store, encode them twice using the base64 command. This prevents secret exposure when GitHub Actions outputs them.

example:
cat clouds.yaml | base64 -w0 | base64 -w0 > clouds-2xb64.yaml cat clouds-env.pkrvars.hcl | base64 -w0 | base64 -w0 >
clouds-2xb64.yaml

2. Pass Encoded Values and Decode in Reusable Workflows: Pass the encoded values as secret inputs to reusable workflows. Inside the workflows, decode them twice before masking to ensure they remain masked throughout the logs and usable in subsequent steps.

Limitation:

Rerunning jobs in debug mode might reveal secrets in the workflow logs. However, only authorized users with "owner" permissions can trigger debug re-runs, mitigating the overall risk.

Benefits:

• Consistent secret masking within reusable workflows.
• Secure handling of multiline secrets and special characters.
• Reduced risk of accidental secret exposure in workflow logs.

Note: The secrets have been renamed as and encoded twice and saved on the Github secret store.

References:
[1.] https://github.com/orgs/community/discussions/65057 [2.] https://github.com/orgs/community/discussions/26671

[askb]

Thanks for the review, test latest run show the required info being filtered out of the console logs.

https://github.com/opendaylight/releng-builder/actions/runs/10275164319/job/28433330366