No Plain Text Action Secrets

Ensure plaintext value is not used for GitHub Action Environment Secret.

For the purposes of security, the contents of the plaintext_value field have been marked as sensitive to Terraform, but this does not hide it from state files. State should be treated as sensitive always.

Impact

Unencrypted sensitive plaintext value can be easily accessible in code.

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

1
2
3
4
5
6
7

resource "github_actions_environment_secret" "good_example" {
	repository       = "my repository name"
	environment       = "my environment"
	secret_name       = "my secret name"
	encrypted_value   = var.some_encrypted_secret_string
}

Links

• https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_environment_secret

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions