HIGH
Source
Trivy
ID
AVD-GIT-0002

Ensure plaintext value is not used for GitHub Action Environment Secret.

For the purposes of security, the contents of the plaintext_value field have been marked as sensitive to Terraform, but this does not hide it from state files. State should be treated as sensitive always.

Impact

Unencrypted sensitive plaintext value can be easily accessible in code.

Follow the appropriate remediation steps below to resolve the issue.

Do not store plaintext values in your code but rather populate the encrypted_value using fields from a resource, data source or variable.

1
2
3
4
5
6
resource "github_actions_environment_secret" "good_example" {
  repository       = "my repository name"
  environment       = "my environment"
  secret_name       = "my secret name"
  encrypted_value   = var.some_encrypted_secret_string
}