From 4b769c5acabc7c10facb4c43c7d95e7fab34bc49 Mon Sep 17 00:00:00 2001
From: Dale Seo <5466341+DaleSeo@users.noreply.github.com>
Date: Mon, 28 Sep 2026 12:03:15 -0400
Subject: [PATCH] ci: reject multi-line codex auth secret

---
 .github/workflows/triage.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 24f86cbc9..21d06aefc 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -89,6 +89,12 @@ jobs:
             exit 1
           fi
 
+          # GitHub masks each line of a multi-line secret, and a masked `{` drops every JSON job output.
+          if [[ "${CODEX_AUTH_JSON%$'\n'}" == *$'\n'* ]]; then
+            echo "::error::CODEX_AUTH_JSON spans multiple lines. Store it with 'jq -c . auth.json | gh secret set CODEX_AUTH_JSON'."
+            exit 1
+          fi
+
           jq -c . "$HOME/.codex/auth.json" > "$RUNNER_TEMP/auth-before.json"
 
       - name: Collect issue