fix: prevent masking gaps in workflow command logs

Normalize displayed command payloads so partial escaping cannot bypass masking,
and retain complete one-character masks.

Assisted-by: Codex:GPT-6

internal/pkg/report/reporter.go

@@ -960,7 +960,7 @@ func logRow(entry logging.Record) *runnerv1.LogRow {
 
 // mask repairs the content first, so a secret the repair itself spells out is still caught.
 func (r *Reporter) mask(content string) string {
-	return r.logReplacer.Replace(strings.ToValidUTF8(content, "?"))
+	return runner.MaskLog(strings.ToValidUTF8(content, "?"), r.logReplacer)
 }
 
 // AddMask deliberately leaves the process-wide masker alone. Its entries come from every live

internal/pkg/report/reporter_test.go

@@ -760,8 +760,7 @@ func TestReporter_ParseResult(t *testing.T) {
 func TestReporter_masksEncodedSecrets(t *testing.T) {
 	secret := `p@ss w"rd/1`
 	r := &Reporter{logReplacer: strings.NewReplacer()}
-	r.oldnew = runner.AppendSecretMasker(r.oldnew, secret)
-	r.logReplacer = strings.NewReplacer(r.oldnew...)
+	r.AddMask(secret)
 
 	for _, line := range []string{
 		"token: " + secret,
@@ -773,6 +772,17 @@ func TestReporter_masksEncodedSecrets(t *testing.T) {
 		assert.NotContains(t, masked, secret)
 		assert.NotContains(t, masked, base64.StdEncoding.EncodeToString([]byte(secret)))
 	}
+
+	r.AddMask("alpha beta;gamma]delta")
+	r.AddMask("%")
+	for _, test := range []struct{ line, want string }{
+		{"##[group]alpha beta%3Bgamma%5Ddelta", "##[group]***"},
+		{"##[group]alpha beta%3Bgamma]delta", "##[group]***"},
+		{"%", "***"},
+	} {
+		r.appendLogRow(logRow(logging.Record{Message: test.line}))
+		assert.Equal(t, test.want, r.logRows[len(r.logRows)-1].Content)
+	}
 }
 
 func TestReporter_AckIndexBeyondBuffer(t *testing.T) {