Call gha-mask writer

tools/env-loader/README.md

@@ -11,6 +11,7 @@ The following input formats are currently supported:
 
 The following output formats are currently supported:
 * dotenv
+* gha-mask
 
 When loading environment values from a given "value set", the tool will search
 for and load the following files in order:
@@ -63,10 +64,3 @@ name of Cloud roles with permission to decrypt secrets in the CI/CD tool value
 store, and then authenticate with the Cloud provider via OIDC. This puts the
 root of trust entirely on the CI/CD tool OIDC provider, rather than the value
 store.
-
-## Future work
-
-* Add tests
-* Add dev tooling
-* Add CI/CD pipelines
-* Add GitHub action

tools/env-loader/action.yaml

@@ -85,4 +85,6 @@ runs:
         ENV_LOADER_ENVIRONMENTS_DIRECTORY: "${{ inputs.environments-directory }}"
         ENV_LOADER_ENVIRONMENT: "${{ inputs.environment-name }}"
         ENV_LOADER_VALUE_SETS: "${{ inputs.value-sets }}"
-      run: env-loader >> "${GITHUB_ENV}"
+      run: |
+        env-loader --format gha-mask
+        env-loader >> "${GITHUB_ENV}"