Combining job outputs with masking leads to empty output

Describe the bug

When combining job outputs with masking the output is empty when used in another job.

To Reproduce Steps to reproduce the behavior:

name: Repro
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
jobs:
  setup:
    name: Setup
    runs-on: ubuntu-latest
    outputs:
      secret: ${{ steps.setup-secret.outputs.secret }}
    steps:
        - name: Setup secret
          id: setup-secret
          shell: pwsh
          run: |
            $secret = "SuperSecret"
            echo "::add-mask::$secret"
            echo "::set-output name=secret::$secret"
  build:
    name: Build
    runs-on: ubuntu-latest
    needs: setup
    steps:
      - name: Run tests
        shell: pwsh
        env:
          SomeEnv: ${{ needs.prepare.outputs.secret}}          
        run: echo ${{ needs.prepare.outputs.secret}} 

Expected behavior

Secret should be available, not empty and masked

Runner Version and Platform

Version of your runner? Current runner version: ‘2.284.0’

OS of the machine running the runner? Linux

What’s not working?

Please include error messages and screenshots.

Job Log Output

Run echo 
  echo 
  shell: /usr/bin/pwsh -command ". '{0}'"
  env:
    SomeEnv: 

cmdlet Write-Output at command pipeline position 1
Supply values for the following parameters:
InputObject: 
Write-Output: /home/runner/work/_temp/a307241a-4c46-4240-9ab0-e317d0006971.ps1:2
Line |
   2 |  echo
     |  ~~~~
     | Cannot process command because of one or more missing
     | mandatory parameters: InputObject.

Error: Process completed with exit code 1.

https://github.com/danielmarbach/GithubActionsWorkflowSharingSpike/runs/4258032273?check_suite_focus=true

Runner and Worker’s Diagnostic Logs

If applicable, add relevant diagnostic log information. Logs are located in the runner’s _diag folder. The runner logs are prefixed with Runner_ and the worker logs are prefixed with Worker_. Each job run correlates to a worker log. All sensitive information should already be masked out, but please double-check before pasting here.

[zacharykeeton]

Not only secrets, but anything, if masked, cannot be referenced into another job:

e.g. when I use amazon-ecr-login get a registry in outputs, https://github.com/marketplace/actions/amazon-ecr-login-action-for-github-actions

      REGISTRY: ${{ steps.login-ecr.outputs.registry }}
outputs:
    registry: ${{ steps.login-ecr.outputs.registry }}

but if I define the registry into output for another job to use, the full registry string is masked like this:

Logging into registry ***.dkr.ecr.ap-southeast-1.amazonaws.com

in another job, use it with jobs.job_id.outputs.registry it got empty

this is a BUG, not only enhancement request in community/community#13082

Suffering the same aws troubles, I found this thread. Later, I found the answer. Returning here to post what I found:

see with: mask-aws-account-id: 'false' in the amazon-ecr-login action https://github.com/aws-actions/amazon-ecr-login

[danielmarbach]

Here we go https://github.com/github/feedback/discussions/13082