GHA Secret Leakage Checker

What this skill does

Scans GitHub Actions run logs for evidence that a secret was echoed to stdout (or stderr) without masking. For each suspect line, suggests a workflow change (add-mask directive or env-var indirection) to prevent recurrence.

Inputs

• repo: <owner>/<name> for the GitHub repo.
• run_ids: comma-separated run IDs to scan, or latest:N for the last N runs.
• GITHUB_TOKEN env var with actions:read scope.
• Optional secret_names: explicit list of secret names registered in the org/repo (so the scan can also look for the names in the logs).

Steps

1. List runs to scan via gh run list --repo <repo> --limit <N> if run_ids=latest:N, else use the explicit list.
2. Download each run's logs: gh run view <run_id> --log to a file per run.
3. Detect known secret shapes via regex:
   • AWS access key: \bAKIA[0-9A-Z]{16}\b.
   • GitHub PAT: \bgh[pousr]_[A-Za-z0-9]{36,255}\b.
   • Slack token: \bxox[bpoars]-[A-Za-z0-9-]{10,72}\b.
   • Generic high-entropy 40+ char hex / base64 strings on lines starting with + echo or = markers.
4. For each match, also search backward in the log for Setting up MASK for value lines; if a mask was set, the leak is double-redaction failure (rare) or a substring leak.
5. If secret_names provided, search the logs for those names appearing alongside = to detect leaks via debug print.
6. Per finding, capture: run_id, step name, line index, redacted snippet (replace the matched secret with [REDACTED] for the report).
7. Suggest workflow fixes: prefix the offending step with echo "::add-mask::${{ secrets.X }}"; or rewrite run: echo $X to never echo at all; or use core.setSecret(value) from @actions/core in JS actions.
8. Emit a markdown report.

Output

secret-leak-report.md with a per-finding section: run link, step name, redacted excerpt, suggested workflow patch. Plus a CSV secret-leaks.csv for tracking. Exit 1 if any finding is found.

Verification

For each finding, rerun the workflow with the proposed fix on a feature branch and re-scan the new run's logs; the regex match must drop to zero. Confirm secret-leaks.csv has one row per occurrence (avoid double-counting the same line). Cross-check by triggering the GitHub secret-scanning push protection — if it would have caught the leak, the report should note severity as critical.

Edge cases

• Logs already partially masked (***): the regex won't match the secret value but the mask itself signals near-misses; surface as info.
• Self-hosted runners with custom log redirection: gh run view --log may be incomplete; warn and recommend mirroring logs centrally.
• Secrets shared across orgs (organization secrets used in forks): forks can't access them, but scan should still run on the parent repo's runs.
• High false-positive rate on test fixtures: allow a .secret-scan-allowlist file with regex exceptions.