# Secret assigned in workflow env

A GitHub Actions env mapping whose key matches those secret-like names and whose value is a non-empty literal.

Area: Security

## What you need to supply

The workflow YAML. The check does not run the workflow.

## If it reports a finding

High severity. The suggested next step is to use a secrets expression or github.token instead of a literal.

## What this does not prove

Values that are ${{ secrets.SOMETHING }}, ${{ github.token }}, or empty are not this finding. A run step that only echoes hello is not this finding. The workflow prints a secret check still applies when a script prints a secrets expression.

## Env mapping that this check is written to notice

```
env:
  TOKEN: literal-secret
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/secret-assigned-in-workflow-env.