Security / Public reference

Secret assigned in workflow env

A GitHub Actions env mapping whose key matches those secret-like names and whose value is a non-empty literal.

What you need to supply

The workflow YAML. The check does not run the workflow.

If it reports a finding

High severity. The suggested next step is to use a secrets expression or github.token instead of a literal.

What this does not prove

Values that are ${{ secrets.SOMETHING }}, ${{ github.token }}, or empty are not this finding. A run step that only echoes hello is not this finding. The workflow prints a secret check still applies when a script prints a secrets expression.

Env mapping that this check is written to notice

env:
  TOKEN: literal-secret

All review checks. Reading this page does not submit your infrastructure.