Generate neo4j password and mask it

Author: JohT

.github/workflows/typescript-code-analysis.yml

@@ -36,7 +36,6 @@ on:
       - '.github/workflows/java-code-analysis.yml'
       - '.github/workflows/*documentation.yml'
 
-# Requires the secret NEO4J_INITIAL_PASSWORD to be configured
 jobs:
   analysis-results:
     runs-on: ubuntu-latest
@@ -64,14 +63,24 @@ jobs:
     - name: (Code Analysis Setup) Set ANALYSIS_NAME
       run: echo "ANALYSIS_NAME=${{ env.PROJECT_NAME }}-${{ env.REACT_ROUTER_VERSION }}" >> $GITHUB_ENV
 
+    - name: (Code Analysis Setup) Generate Neo4j Initial Password
+      id: generate_neo4j_initial_password
+      shell: bash
+      # generated_password=$(LC_ALL=C tr -dc 'A-Za-z0-9!?%=' < /dev/urandom | head -c 10)
+      run: |
+        generated_password=$( LC_ALL=C tr -dc '[:graph:]' </dev/urandom | head -c 12; echo )
+        echo "$generated_password"
+        echo "::add-mask::$generated_password"
+        echo "neo4j_initial_password=$generated_password" >> "$GITHUB_OUTPUT"
+          
     - name: Setup Code Analysis
       uses: ./.github/actions/setup-code-analysis
       with:
         java-version: ${{ matrix.java }}
         python-version: ${{ matrix.python }}
         miniforge-version: ${{ matrix.miniforge }}
         analysis-name: ${{ env.ANALYSIS_NAME }}
-        neo4j-password: ${{ secrets.NEO4J_INITIAL_PASSWORD }}
+        neo4j-password: ${{ steps.generate_neo4j_initial_password.outputs.neo4j_initial_password }}
 
     - name: (Code Analysis Setup) Download ${{ env.ANALYSIS_NAME }}
       working-directory: code-graph-analysis-pipeline/temp/${{ env.ANALYSIS_NAME }}
@@ -93,7 +102,7 @@ jobs:
       # Shell type can be skipped if jupyter notebook analysis-results (and therefore conda) aren't needed
       shell: bash -el {0}
       env:
-        NEO4J_INITIAL_PASSWORD: ${{ secrets.NEO4J_INITIAL_PASSWORD }}
+        NEO4J_INITIAL_PASSWORD: ${{ steps.generate_neo4j_initial_password.outputs.neo4j_initial_password }}
         ENABLE_JUPYTER_NOTEBOOK_PDF_GENERATION: "true"
         IMPORT_GIT_LOG_DATA_IF_SOURCE_IS_PRESENT: "" # Options: "none", "aggregated", "full". default = "plugin" or ""
       run: |