From 9d9775ec103a5a5e07d34ec198ebb9317677e070 Mon Sep 17 00:00:00 2001
From: Dale Seo <5466341+DaleSeo@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:58:25 -0400
Subject: [PATCH] ci(triage): redact command output from failure logs

---
 .github/workflows/triage.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 774230815..d09a3e68d 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -280,7 +280,12 @@ jobs:
             --json \
             - < triage-prompt.md > codex-events.jsonl 2>&1 || {
               echo "::error::Codex exited non-zero. Last events:"
-              tail -5 codex-events.jsonl >&2
+              # Run logs are public and command output can echo ~/.codex/auth.json, so
+              # print only event types and Codex's own error messages.
+              jq -Rr 'fromjson? | select(type == "object")
+                      | [.type, .item.type, .error.message // .message]
+                      | map(select(. != null)) | join(" ")' \
+                codex-events.jsonl | tail -5 >&2
               exit 1
             }