fix: mask proxy URL credentials in job logs

Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment
variables was never registered as a secret, so error messages carrying
the proxy URL printed the credentials unmasked in the job log.

test/helpers.test.ts

@@ -126,6 +126,29 @@ describe('Configure AWS Credentials helpers', {}, () => {
     expect(core.exportVariable).toHaveBeenCalledWith('AWS_SESSION_TOKEN', '');
   });
 
+  describe('maskProxyCredentials', {}, () => {
+    it('masks username and password embedded in a proxy URL', {}, () => {
+      helpers.maskProxyCredentials('http://user:secretpass@proxy.example.com:8080');
+      expect(core.setSecret).toHaveBeenCalledWith('user');
+      expect(core.setSecret).toHaveBeenCalledWith('secretpass');
+    });
+
+    it('masks both encoded and decoded forms of the credentials', {}, () => {
+      helpers.maskProxyCredentials('http://user:p%40ss@proxy.example.com:8080');
+      expect(core.setSecret).toHaveBeenCalledWith('p%40ss');
+      expect(core.setSecret).toHaveBeenCalledWith('p@ss');
+    });
+
+    it('masks the whole value even without embedded credentials or when unparseable', {}, () => {
+      helpers.maskProxyCredentials('http://proxy.example.com:8080');
+      expect(core.setSecret).toHaveBeenCalledWith('http://proxy.example.com:8080');
+      helpers.maskProxyCredentials('not a url');
+      expect(core.setSecret).toHaveBeenCalledWith('not a url');
+      // no username/password parts, so exactly one mask per call
+      expect(core.setSecret).toHaveBeenCalledTimes(2);
+    });
+  });
+
   describe('validateAccountId', {}, () => {
     it('enforces the allow-list even when the first element is empty', {}, () => {
       expect(() => helpers.validateAccountId(['', '999999999999'], '111111111111')).toThrow(/does not match/);

test/index.test.ts

@@ -1267,6 +1267,21 @@ describe('Configure AWS Credentials', {}, () => {
 
       expect(core.setFailed).not.toHaveBeenCalled();
     });
+
+    it('masks credentials embedded in the proxy URL', async () => {
+      vi.mocked(core.getInput).mockImplementation(
+        mocks.getInput({
+          ...mocks.GH_OIDC_INPUTS,
+          'http-proxy': 'http://user:secretpass@proxy.example.com:8080',
+        }),
+      );
+
+      await run();
+
+      expect(core.setSecret).toHaveBeenCalledWith('user');
+      expect(core.setSecret).toHaveBeenCalledWith('secretpass');
+      expect(core.setFailed).not.toHaveBeenCalled();
+    });
   });
 
   describe('AWS Profile Support', {}, () => {