Add masking

Author: shijie-oai

.github/workflows/rust-release.yml

@@ -40,6 +40,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          echo "::add-mask::$APPLE_CODESIGN_IDENTITY"
           echo "::group::Tag validation"
 
           # 1. Must be a tag and match the regex
@@ -228,7 +229,7 @@ jobs:
                 security find-identity -v -p codesigning "${APPLE_CODESIGN_KEYCHAIN}" || true
                 security find-certificate -a -Z "${APPLE_CODESIGN_KEYCHAIN}" || true
               echo "::endgroup::"
-            if
+            fi
           fi
 
           for binary in codex codex-responses-api-proxy; do