GitHub extends secret scanning to Actions workflow logs

A build step that echoes a token to its log is a common accident. On most teams nobody sees it until an outside tool finds it, or a wrong person does. GitHub posted a changelog entry on 9 November. Secret scanning can now look at the logs of Actions workflow runs. The setting is in public preview. Before, secret scanning read code, issues, wikis, discussions and pull requests. GitHub adds workflow logs to that list.

What the feature checks

The scan runs on provider patterns when a workflow run finishes. A finding goes into the same repository alert list as a leak in the code. The alert carries a link back to the Actions workflow log that holds the match. GitHub says validity checks run for supported secret types. The entry does not list which types. The check runs after the run. It does not stop a job in the middle. The job finishes, and the finding shows up with the rest.

Who can turn it on

The feature is open to enterprises on GitHub Enterprise Cloud that pay for GitHub Secret Protection or GitHub Advanced Security. The setting lives in enterprise settings under Policies, Advanced Security. An enterprise owner picks Enabled from the All repositories dropdown. A team on Pro, Team or free GitHub does not get this setting today. A team on GitHub Enterprise Server is not named in the entry either.

Only new runs are scanned

GitHub says the scan reads workflow runs that complete after the setting is turned on. Older logs are not read. A team that turns the setting on today does not learn about a leak in a run from last week. The old logs still carry the token. Any credential a workflow has ever printed to its log should be treated as public. Rotate it, revoke it, and limit its scope.

What a team should do this week

Turn on the setting if the account has Secret Protection or Advanced Security. Watch the alert list for a few days to see what the scan finds. Many findings means a step somewhere is printing a token. That step needs a fix in the workflow file. The fix is often one option on an action. The other option is ::add-mask::, which hides a value that must appear in a log for a reason. For a leak the scan cannot reach, which is every leak before today, the old rule still holds. Rotate every token the workflow could have printed, every time a new provider shows up in the alert list.

A team on free, Pro or Team still has to fall back to open tools. The Actions log is public on a public repository. A token in it is already copied to every machine that has ever read the run page. Secret scanning on logs is a safety net for a team that was already careful. It is not a fix for the habit of printing a secret to see what it is.

Source

GitHub Changelog, "Secret scanning detects secrets in GitHub Actions workflow logs".