Make sure that username and password are masked, before turning on verbose

entrypoint.sh

@@ -5,6 +5,8 @@ main() {
   echo "" # see https://github.com/actions/toolkit/issues/168
 
   if usesBoolean "${ACTIONS_STEP_DEBUG}"; then
+    echo "::add-mask::${INPUT_USERNAME}"
+    echo "::add-mask::${INPUT_PASSWORD}"
     set -x
   fi
 

test.bats

@@ -569,7 +569,9 @@ teardown() {
 
   run /entrypoint.sh
 
-  expectStdOutContains "sanitize my/repository name" # prints the commands
+  expectStdOutContains "::add-mask::USERNAME
+::add-mask::PASSWORD
++ sanitize my/repository name"
 }
 
 function expectStdOutContains() {