Sanitize secret-bearing data before writing GitHub step summaries #50769

Problem

Several paths serialize agent-controlled or tool-controlled data directly into $GITHUB_STEP_SUMMARY:

• Copilot log rendering enables detailed tool parameters and renders JSON.stringify(input).
• Safe-output summaries include body previews, error message objects, and unbounded message.data.

GitHub Actions ::add-mask:: processing does not reliably scrub step-summary file contents. Tool arguments, outputs, headers, URLs, prompts, or safe-output payloads can therefore persist in cleartext.

Plan

1. Introduce a summary-safe rendering boundary that sanitizes structured values before Markdown generation.
2. Default tool rendering to operation name and non-sensitive metadata; omit raw parameters and responses.
3. Replace raw safe-output body/data rendering with allowlisted fields or sanitized, bounded previews.
4. Ensure error paths follow the same policy.
5. Add tests that write sentinel secrets through each input shape and assert absence from generated Markdown.

Acceptance criteria

• Step summaries never contain literal secret values from tool inputs, outputs, message bodies, message data, or error objects.
• Useful metadata such as tool name, duration, status, and safe file paths remains available.
• Nested objects, arrays, multiline strings, URLs, and encoded-looking values are covered by tests.
• No code path assumes Actions masking will sanitize summary files.

Relevant files

• actions/setup/js/parse_copilot_log.cjs
• actions/setup/js/log_parser_format.cjs
• actions/setup/js/log_parser_bootstrap.cjs
• actions/setup/js/safe_output_summary.cjs