No Plain Text Action Secrets | Vulnerability Database

Ensure plaintext value is not used for GitHub Action Environment Secret.

For the purposes of security, the contents of the plaintext_value field have been marked as sensitive to Terraform, but this does not hide it from state files. State should be treated as sensitive always.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Do not store plaintext values in your code but rather populate the encrypted_value using fields from a resource, data source or variable.

1
2
3
4
5
6


resource "github_actions_environment_secret" "good_example" {
  repository      = "my repository name"
  environment     = "my environment"
  secret_name     = "my secret name"
  encrypted_value = var.some_encrypted_secret_string
}

Remediation Links

https://registry.terraform.io/providers/integrations/github/latest/docs/resources/actions_environment_secret
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions