From 4b8b5e37b44d9d86b7b93b3022c8f4c9b9eaa361 Mon Sep 17 00:00:00 2001
From: Tom Keller <kellertk@amazon.com>
Date: Mon, 31 Aug 2026 12:03:31 -0700
Subject: [PATCH] fix: omit account IDs from the allowed-account-ids failure
 message

The mismatch error is thrown before exportAccountId registers the
account-id mask, so setFailed wrote the raw account ID (and the
configured allow-list) into a public annotation. (C4)
---
 src/helpers.ts     |  7 ++-----
 test/index.test.ts | 10 +++++-----
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/src/helpers.ts b/src/helpers.ts
index c65f297..b304db6 100644
--- a/src/helpers.ts
+++ b/src/helpers.ts
@@ -171,11 +171,8 @@ export function validateAccountId(expectedAccountIds: string[] | undefined, acco
     return;
   }
   if (!account || !allowedAccountIds.includes(account)) {
-    throw new Error(
-      `The account ID of the provided credentials (${
-        account ?? 'unknown'
-      }) does not match any of the expected account IDs: ${allowedAccountIds.join(', ')}`,
-    );
+    // Account IDs are deliberately omitted: this error reaches the job log before any mask exists.
+    throw new Error('The account ID of the provided credentials does not match any of the allowed account IDs');
   }
 }
 
diff --git a/test/index.test.ts b/test/index.test.ts
index 7b9aafd..18665ca 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -841,7 +841,7 @@ describe('Configure AWS Credentials', {}, () => {
 
       await run();
       expect(core.setFailed).toHaveBeenCalledWith(
-        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+        'The account ID of the provided credentials does not match any of the allowed account IDs',
       );
     });
 
@@ -861,7 +861,7 @@ describe('Configure AWS Credentials', {}, () => {
 
       await run();
       expect(core.setFailed).toHaveBeenCalledWith(
-        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999, 888888888888',
+        'The account ID of the provided credentials does not match any of the allowed account IDs',
       );
     });
 
@@ -917,7 +917,7 @@ describe('Configure AWS Credentials', {}, () => {
 
       await run();
       expect(core.setFailed).toHaveBeenCalledWith(
-        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+        'The account ID of the provided credentials does not match any of the allowed account IDs',
       );
     });
 
@@ -936,7 +936,7 @@ describe('Configure AWS Credentials', {}, () => {
 
       await run();
       expect(core.setFailed).toHaveBeenCalledWith(
-        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+        'The account ID of the provided credentials does not match any of the allowed account IDs',
       );
     });
 
@@ -956,7 +956,7 @@ describe('Configure AWS Credentials', {}, () => {
 
       await run();
       expect(core.setFailed).toHaveBeenCalledWith(
-        'The account ID of the provided credentials (111111111111) does not match any of the expected account IDs: 999999999999',
+        'The account ID of the provided credentials does not match any of the allowed account IDs',
       );
     });