Original announcement: · Reporting prepared on the publication date above.
What to know
- A GitHub public preview adds secret detection to completed Actions logs, but it does not replace careful credential handling.
Where the new scan looks
GitHub announced a public preview on November 9 that scans completed Actions workflow logs for supported provider patterns. Findings appear in secret-scanning alerts. It is available to eligible Enterprise Cloud customers with Secret Protection or Advanced Security and is disabled by default.
The limits matter
Earlier logs are not scanned retroactively. Masked secrets and several pattern types are outside this preview, and alerts do not send notifications during preview. Review the alert list directly and rotate any credential that was exposed; deleting a log is not a credential rotation.
For server deployments, use short-lived tokens where possible, restrict scopes and avoid printing environment variables. Our OIDC deployment guide covers a safer path to a cloud server.
Sources & further reading
Primary sources supporting this article. The practical recommendations are Kiava’s general guidance and should be adapted to your project.
Your experience. The next chapter.
Tried this guide, or have a question? Add your experience to the conversation.
This conversation starts with you.
A useful question or a short experience can help the next reader.
Discussion 0
Newest first