Reduce custom secret minimum length threshold from 8 to 6 characters

[Copilot]

Lowered the minimum length threshold for custom secrets from 8 to 6 characters in redact_secrets.cjs. Well-known secrets (GitHub tokens, API keys, etc.) remain pattern-matched via regex and are unaffected by this threshold.

Changes

• redact_secrets.cjs: Changed minimum length check from < 8 to < 6 for custom secrets
• redact_secrets.test.cjs:
  • Updated "skip very short values" test to verify 5-character secrets are ignored
  • Added test case confirming 6-character secrets are now redacted

Context

Custom secrets are loaded from environment variables and checked against a length threshold before redaction. The BUILT_IN_PATTERNS array (16 well-known credential formats) operates independently via regex matching:

// Custom secrets: now 6+ chars required
if (!secretValue || secretValue.length < 6) {
  continue;
}

// Well-known patterns: length-independent
const BUILT_IN_PATTERNS = [
  { name: "GitHub Personal Access Token", pattern: /ghp_[0-9a-zA-Z]{36}/g },
  { name: "OpenAI API Key", pattern: /sk-[a-zA-Z0-9]{48}/g },
  // ... 14 more patterns
];

This allows shorter legitimate secrets (e.g., 6-7 character API keys) to be redacted while avoiding false positives from 1-5 character strings.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR reduces the minimum length threshold for custom secret redaction from 8 to 6 characters in redact_secrets.cjs, allowing shorter legitimate secrets (such as 6-7 character API keys) to be redacted while still avoiding false positives from very short strings. Well-known credential patterns (GitHub tokens, API keys, etc.) continue to use regex-based detection independent of this threshold.

Changes:

• Lowered custom secret minimum length from 8 to 6 characters in the redaction logic
• Updated test suite to verify the new boundary: 5-character secrets are skipped, 6-character secrets are redacted

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
actions/setup/js/redact_secrets.cjs	Changed minimum length check from < 8 to < 6 for custom secrets at line 117
actions/setup/js/redact_secrets.test.cjs	Updated "skip very short values" test to use 5-character secret and added new test case confirming 6-character secrets are now redacted

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.