fix(gha): register resolved secrets with runner masking

[Copilot]

Pull Request

What does this PR do?

Registers every non-empty secret resolved by the GitHub Action with runner masking before the value is written to the environment file.

• Runner masking

  • Adds an escaped ::add-mask:: adapter behind an injected ISecretMasker port.
  • Keeps GitHub-specific behavior out of the domain layer.

  this.secretMasker.mask(value);
  existingEnvVariables[envVar] = value;

• Runtime wiring

  • GitHub Action binds the runner masker.
  • CLI binds a no-op implementation, preserving existing behavior.

• Documentation

  • Clarifies exact-value masking limits.
  • Recommends ${{ runner.temp }}/envilder.env when consumers support an explicit path.

Related issues

Type of change

• Feature
• Bugfix
• Refactor
• Documentation
• Other

Checklist

• Tests added/updated (if needed)
• Docs updated (if needed)
• Lint/format pass

Notes for reviewer

Tests cover raw runner-mask registration before persistence, exclusion of missing/empty values, command escaping, and CLI/GHA DI bindings.

• Fixes fix(gha): register resolved secrets with runner masking #476

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[Copilot]

Pull request overview

Registers resolved GitHub Action secrets with GitHub runner masking by introducing an ISecretMasker port and wiring a GitHub-specific adapter in the GHA container while keeping CLI behavior unchanged (no-op masker).

Changes:

• Added ISecretMasker domain port plus GitHub Actions and no-op implementations.
• Updated PullSecretsToEnvCommandHandler to register each non-empty resolved value with the masker before persisting.
• Updated DI wiring and tests for CLI/GHA startup resolution, plus GitHub Action docs about masking limits and safer env-file paths.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/envilder/core/infrastructure/github/GitHubActionsSecretMasker.test.ts	Adds unit coverage for escaped ::add-mask:: emission.
tests/envilder/core/application/pullSecretsToEnv/PullSecretsToEnvCommandHandler.test.ts	Verifies masking happens before save and skips empty/missing values.
tests/envilder/apps/gha/Startup.test.ts	Asserts GHA binds ISecretMasker to GitHubActionsSecretMasker.
tests/envilder/apps/cli/Startup.test.ts	Asserts CLI binds ISecretMasker to NoOpSecretMasker.
src/envilder/core/types.ts	Registers ISecretMasker symbol for DI.
src/envilder/core/infrastructure/github/NoOpSecretMasker.ts	Introduces no-op masker for non-GHA runtimes.
src/envilder/core/infrastructure/github/GitHubActionsSecretMasker.ts	Implements escaped ::add-mask:: emission for runner masking.
src/envilder/core/domain/ports/ISecretMasker.ts	Adds new domain port interface.
src/envilder/core/application/pullSecretsToEnv/PullSecretsToEnvCommandHandler.ts	Calls secretMasker.mask(value) before persisting resolved secrets.
src/envilder/apps/shared/ContainerConfiguration.ts	Binds default ISecretMasker to no-op when not explicitly provided.
src/envilder/apps/gha/Startup.ts	Overrides ISecretMasker binding to GitHub Actions implementation.
github-action/README.md	Documents masking behavior/limitations and recommends ${{ runner.temp }} env file path when possible.