Inconsistent masking of Secrets when action fails about deploy-cloudrun HOT 2 CLOSED

Hi @erzz

Thank you for opening an issue. GitHub Actions (the platform) is what actually performs secret scrubbing. Two things here:

1. I would recommend opening a security issue with GitHub. It looks like, from your example, it's possible to exfiltrate secrets from a shared workflow because the "secret" provenance is lost.
2. I would suggest switching to the native Cloud Run Secret Manager integration. That would prevent this type of leak because the secrets are resolved at runtime instead of deploy time.

I don't know if there's anything we can do in our action, since you're passing secrets via environment variables. It would not be safe for us to parse and mark values as secret, since not all environment variables are secret.

from deploy-cloudrun.

Hi @sethvargo - thanks for getting back!

1. I think you are perhaps correct - that a secret (reusable workflow) --> input (action) is not honoured in their scrubbing mechanism
2. Agreed! This was an older project started before secret manager was available in CR

Alright lets close this for now and I will raise an issue with Github. Thanks!

from deploy-cloudrun.