Feature request: share credentials between jobs (job outputs)

[pascalgulikers]

Select Topic Area

Feature request: add a secret output option which makes output values masked between jobs, for instance:
echo "mysecret=MySecretValue" >> $GITHUB_SECRET_OUTPUT

Body

See: aws-actions/amazon-ecr-login#483

To pull a custom container image at job level, credentials might be needed, i.e.

job-1:
    environment: ${{ needs.Initialize.outputs.environment }}
    runs-on: ubuntu-latest
    needs: [Initialize, Setup]
    permissions:
      contents: write
      packages: write
      pull-requests: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    outputs:
      registry: ${{ steps.login-ecr.outputs.registry }}
### The following 2 lines of code are trying to leak secret data to non secret storage
      docker_username: ${{ steps.login-ecr.outputs[format('docker_username_{0}_dkr_ecr_eu_central_1_amazonaws_com', needs.Setup.outputs.accountId)] }}
      docker_password: ${{ steps.login-ecr.outputs[format('docker_password_{0}_dkr_ecr_eu_central_1_amazonaws_com', needs.Setup.outputs.accountId)] }}
    steps:
      - name: 'Configure AWS Credentials'
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-region: ${{ inputs.region }}
          role-to-assume: arn:aws:iam::${{ needs.Setup.outputs.accountId }}:role/${{ inputs.ghaIamRolePrefix }}-${{ github.event.repository.name }}
          role-session-name: GitHubActions
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
        
job-2:
    environment: ${{ needs.Initialize.outputs.environment }}
    runs-on: [self-hosted, X64, Linux, default ]
    needs: [Initialize, Setup, job-1]
    container: 
      image: ***.dkr.ecr.eu-central-1.amazonaws.com/our_custom_baseimage:latest
      credentials:
        username: ${{ needs.job-1.outputs.docker_username }}
        password: ${{ needs.job-1.outputs.docker_password }}

The above example works, but ofcourse the credentials are visible in the job output. echo ::add_mask:: isn't helpful, see: actions/runner#475

Feature request: add a secret output option which makes output values masked between jobs, for instance:
echo "mysecret=MySecretValue" >> $GITHUB_SECRET_OUTPUT

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬