From 66456013778290f296b18ad8f5ed1e7f5233406c Mon Sep 17 00:00:00 2001
From: stack72 <public@paulstack.co.uk>
Date: Sat, 4 Jul 2026 21:49:27 +0100
Subject: [PATCH] fix: avoid exposing sensitive info in auth verification step

The whoami command outputs user details (email, collectives, etc.) into
the CI logs. Use --json output with jq to check only the authenticated
field, and print a generic success message instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 action.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 632e69d..1264bf7 100644
--- a/action.yml
+++ b/action.yml
@@ -71,7 +71,12 @@ runs:
       if: inputs.api-key != ''
       shell: bash
       run: |
-        swamp auth whoami
+        AUTH_STATUS=$(swamp auth whoami --json | jq -r '.authenticated')
+        if [ "$AUTH_STATUS" != "true" ]; then
+          echo "::error::Authentication failed"
+          exit 1
+        fi
+        echo "Authentication verified successfully"
 
     - name: Initialize repository
       if: inputs.repo-init == 'true'