[DerekRoberts]

Problem

The deployer rendered the template with oc process --local and then:

• wrote the whole rendered JSON into $GITHUB_ENV (TEMPLATE<<EOF). GitHub prints job env vars in the env: header of every later step, so the full rendered template, including any Secret values, showed up in the log of every following step in the caller's job;
• with debug: true, echoed the full template before and after lite mode.

Secret masking does not reliably catch this: the output is JSON, which escapes characters such as &, <, > and quotes (\u0026 etc.), so a masked secret containing them no longer matches and is printed in clear.

Fix

Stop showing template contents at all instead of relying on redaction:

• the rendered template is written to a chmod 600 file under $RUNNER_TEMP; only its path is passed on (step output)
• DeploymentConfig check, ImageStream cleanup, lite mode, oc apply/oc create and the rollout lookup all read that file
• debug: true now lists kind/name only
• cleanup always happens: the file is created with umask 077 via mktemp in $RUNNER_TEMP; a final if: always() step (runs on success, failure and cancellation) removes it with rm -f, which cannot fail; the lite-mode intermediate is removed by a trap ... EXIT in its own step, and lite mode no longer writes .template*.json into the workspace
• the TEMPLATE env var is no longer exported to the caller's job

oc apply/oc create output is unchanged (kind/name only).