test secret inputs

.github/workflows/release.yaml

@@ -8,12 +8,23 @@ on:
         required: true
         type: boolean
         default: true
+      cargo-registry-token: 
+        description: 'CARGO_REGISTRY_TOKEN'
+        required: true
+        type: string
 
 jobs:
   publish:
     runs-on: windows-latest
 
     steps:
+    - name: Mask secrets
+      run: |
+        CARGO_REGISTRY_TOKEN=$(jq -r '.inputs.cargo-registry-token' $GITHUB_EVENT_PATH)
+        echo ::add-mask::$CARGO_REGISTRY_TOKEN
+        echo CARGO_REGISTRY_TOKEN=$CARGO_REGISTRY_TOKEN >> $GITHUB_ENV
+    - name: Test secret mask
+      run: echo "this is not the secret you fool ${{ env.CARGO_REGISTRY_TOKEN}} "
     - name: Checkout repository
       uses: actions/checkout@v4
 
@@ -41,7 +52,7 @@ jobs:
     - name: Run cargo publish
       if : ${{ !fromJSON(inputs.dry-run) }}
       env:
-        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        CARGO_REGISTRY_TOKEN: ${{ env.CARGO_REGISTRY_TOKEN }}
       run: cargo publish 
 
     - name: Run cargo publish --dry-run