feat: mask authHeader with core.setSecret in git_auth_helpers

[Copilot]

overridePersistedExtraheader computes a base64-encoded Authorization: basic header but never registers it with the runner's secret masking. While the primary protection is { silent: true } on all credential-bearing exec calls (merged in #50636), the derived base64 value remains unmasked in runner logs if it surfaces through any other path.

Changes

• git_auth_helpers.cjs — call core.setSecret(tokenBase64) immediately after computing the base64 value:

  const tokenBase64 = Buffer.from(`x-access-token:${token.trim()}`).toString("base64");
  core.setSecret(tokenBase64);
  const authHeader = `Authorization: basic ${tokenBase64}`;

• git_auth_helpers.test.cjs — add assertion that setSecret is called with the expected base64 value
• git_auth_helpers.integration.test.cjs — add setSecret: vi.fn() to the mock core object

[Copilot]

Pull request overview

Adds runner-side masking for the derived Git authorization value, completing the defense-in-depth protection from #50636.

Changes:

• Registers the base64 token with core.setSecret.
• Adds unit coverage and updates integration mocks.

Show a summary per file

File	Description
actions/setup/js/git_auth_helpers.cjs	Masks the derived credential value.
actions/setup/js/git_auth_helpers.test.cjs	Verifies secret registration.
actions/setup/js/git_auth_helpers.integration.test.cjs	Adds the required setSecret mock.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.85.4