ci: mask the AWS account ID in job logs

[nickpell]

Summary

This repository is public, so its job logs are public. The AWS account ID reaches those logs through the ECR registry hostname and through the role ARN the credentials step assumes.

Today the ID is masked only as a side effect of being carried in the AWS_ACCOUNT_ID repository secret, which GitHub redacts wherever the secret's own value appears. aws-actions/configure-aws-credentials does not mask the account ID by default, so anything the action or a later step derives and prints — an assumed-role ARN, a caller identity, an ECR registry the action itself resolves — is not covered by that redaction.

mask-aws-account-id: true registers the account ID as a masked value for the rest of the job, so those derived forms stay masked too. Added to both configure-aws-credentials steps in the repository: .github/workflows/docker.yml and .github/workflows/eif-build.yml. No other behavior changes; the ratchet pins and their comments are untouched.

Pre-merge checklist

• Lint passes (Ratchet Lint: mise run //:ratchet:lint, and mise run //:ratchet:pin leaves no diff)
• Diff contains no unintended changes (two added lines, one per workflow; ratchet pins and their comments unchanged)
• CI checks green on the head commit (Ratchet Lint, lint, test all pass on 9f6b752)

Post-deploy/apply verification

• The first main-branch run after merge shows mask-aws-account-id: true among the credentials step's inputs in the log (Docker Build run 35112420899 on c2abdde: input line(s) present)
• gh run view <id> --log for that run contains no unmasked occurrence of the account ID (run 35112420899: zero matches for the raw account ID, ECR hostnames and ARNs render as ***)

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Both credential steps use the supported masking input without altering functional behavior.

Pull request overview

Adds explicit AWS account ID masking to public CI logs.

Changes:

• Enables account ID masking in both AWS credential steps.
• Preserves existing action pins and workflow behavior.

File summaries

File	Description
.github/workflows/eif-build.yml	Masks the account ID during EIF build authentication.
.github/workflows/docker.yml	Masks the account ID during ECR publishing authentication.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.