starred/act
1
0
Fork 0
mirror of https://github.com/nektos/act.git synced 2026-04-26 01:15:51 +03:00
Code Issues 289 Projects Releases 5 Packages Wiki Activity

[GH-ISSUE #2196] .secrets file is exposed to workflows #1038

New issue
Open
opened 2026-03-01 21:48:23 +03:00 by kerem · 20 comments
kerem commented 2026-03-01 21:48:23 +03:00
Owner
Copy link

Originally created by @jsoref on GitHub (Feb 1, 2024).
Original GitHub issue: https://github.com/nektos/act/issues/2196

Bug report info

act version:            4ca35d2
GOOS:                   darwin
GOARCH:                 arm64
NumCPU:                 10
Docker host:            DOCKER_HOST environment variable is not set
Sockets found:
	/var/run/docker.sock
Config files:           
	/Users/jsoref/.actrc:
		#-P ubuntu-latest=node:12.20.1-buster-slim
		#-P ubuntu-20.04=node:12.20.1-buster-slim
		#-P ubuntu-18.04=node:12.20.1-buster-slim
		-P ubuntu-latest=catthehacker/ubuntu:act-latest
		-P ubuntu-22.04=catthehacker/ubuntu:act-22.04
		-P ubuntu-20.04=catthehacker/ubuntu:act-20.04
		-P ubuntu-18.04=catthehacker/ubuntu:act-18.04
		-P ubuntu-16.04=catthehacker/ubuntu:act-16.04
		-P self-hosted=catthehacker/ubuntu:act-latest
		-P ubuntu-latest-4cpu=ubuntu:act-latest
		-P ubuntu-latest-8cpu=ubuntu:act-latest
Build info:
	Go version:            go1.21.6
	Module path:           command-line-arguments
	Main version:          
	Main path:             
	Main checksum:         
	Build settings:
		-buildmode:           exe
		-compiler:            gc
		-ldflags:             -X main.version=4ca35d2
		DefaultGODEBUG:       panicnil=1
		CGO_ENABLED:          1
		CGO_CFLAGS:           
		CGO_CPPFLAGS:         
		CGO_CXXFLAGS:         
		CGO_LDFLAGS:          
		GOARCH:               arm64
		GOOS:                 darwin
Docker Engine:
	Engine version:        23.0.6
	Engine runtime:        runc
	Cgroup version:        1
	Cgroup driver:         cgroupfs
	Storage driver:        overlay2
	Registry URI:          https://index.docker.io/v1/
	OS:                    Alpine Linux v3.18
	OS type:               linux
	OS version:            3.18.5
	OS arch:               aarch64
	OS kernel:             6.1.64-0-virt
	OS CPU:                2
	OS memory:             1973 MB
	Security options:
		name=seccomp,profile=builtin

Command used with act

~/code/nektos/act/dist/local/act --use-new-action-cache -j prettier

Describe issue

the prettier workflow i'm using does a git add ., a git commit, and a git show HEAD (or something functionally equivalent).

The output shows that the .secrets file is included in the workspace and thus effectively leaked to the workflow

Link to GitHub repository

No response

Workflow content

name: Prettier for JS/TypeScript Code

on:
  push

jobs:
  prettier:
    name: Prettier
    runs-on: ubuntu-latest

    steps:
      - name: Prettier
        uses: garnercorp/build-actions/prettier@updates
        with:
          prettier-options: "--write **/*.ts"
          push-to-remote: false

Relevant log output

| No package-lock.json file.
| [action-prettier d4cee98] Prettified Code!
|  Author: nektos/act <nektos/act@users.noreply.github.com>
|  2 files changed, 2 insertions(+)
|  create mode 100644 .dockerignore
|  create mode 100644 .secrets

The .dockerignore was because i wanted to see if using .secrets in .dockerignore would fix it -- it didn't

Additional information

I "worked around" this by using --secret-file .git/act-secrets, but this didn't technically protect the file from being leaked to the workflow, it just prevented the git commit from catching the file.

Originally created by @jsoref on GitHub (Feb 1, 2024). Original GitHub issue: https://github.com/nektos/act/issues/2196 ### Bug report info ```plain text act version: 4ca35d2 GOOS: darwin GOARCH: arm64 NumCPU: 10 Docker host: DOCKER_HOST environment variable is not set Sockets found: /var/run/docker.sock Config files: /Users/jsoref/.actrc: #-P ubuntu-latest=node:12.20.1-buster-slim #-P ubuntu-20.04=node:12.20.1-buster-slim #-P ubuntu-18.04=node:12.20.1-buster-slim -P ubuntu-latest=catthehacker/ubuntu:act-latest -P ubuntu-22.04=catthehacker/ubuntu:act-22.04 -P ubuntu-20.04=catthehacker/ubuntu:act-20.04 -P ubuntu-18.04=catthehacker/ubuntu:act-18.04 -P ubuntu-16.04=catthehacker/ubuntu:act-16.04 -P self-hosted=catthehacker/ubuntu:act-latest -P ubuntu-latest-4cpu=ubuntu:act-latest -P ubuntu-latest-8cpu=ubuntu:act-latest Build info: Go version: go1.21.6 Module path: command-line-arguments Main version: Main path: Main checksum: Build settings: -buildmode: exe -compiler: gc -ldflags: -X main.version=4ca35d2 DefaultGODEBUG: panicnil=1 CGO_ENABLED: 1 CGO_CFLAGS: CGO_CPPFLAGS: CGO_CXXFLAGS: CGO_LDFLAGS: GOARCH: arm64 GOOS: darwin Docker Engine: Engine version: 23.0.6 Engine runtime: runc Cgroup version: 1 Cgroup driver: cgroupfs Storage driver: overlay2 Registry URI: https://index.docker.io/v1/ OS: Alpine Linux v3.18 OS type: linux OS version: 3.18.5 OS arch: aarch64 OS kernel: 6.1.64-0-virt OS CPU: 2 OS memory: 1973 MB Security options: name=seccomp,profile=builtin ``` ### Command used with act ```sh ~/code/nektos/act/dist/local/act --use-new-action-cache -j prettier ``` ### Describe issue the prettier workflow i'm using does a `git add .`, a `git commit`, and a `git show HEAD` (or something functionally equivalent). The output shows that the `.secrets` file is included in the workspace and thus effectively leaked to the workflow ### Link to GitHub repository _No response_ ### Workflow content ```yml name: Prettier for JS/TypeScript Code on: push jobs: prettier: name: Prettier runs-on: ubuntu-latest steps: - name: Prettier uses: garnercorp/build-actions/prettier@updates with: prettier-options: "--write **/*.ts" push-to-remote: false ``` ### Relevant log output ```sh | No package-lock.json file. | [action-prettier d4cee98] Prettified Code! | Author: nektos/act <nektos/act@users.noreply.github.com> | 2 files changed, 2 insertions(+) | create mode 100644 .dockerignore | create mode 100644 .secrets ``` The `.dockerignore` was because i wanted to see if using `.secrets` in `.dockerignore` would fix it -- it didn't ### Additional information I "worked around" this by using `--secret-file .git/act-secrets`, but this didn't technically protect the file from being leaked to the workflow, it just prevented the git commit from catching the file.
kerem commented 2026-03-01 21:48:24 +03:00
Author
Owner
Copy link

@ChristopherHX commented on GitHub (Feb 1, 2024):

I have a question about this problem, because I don't fully understand it.

Does .gitignore exclude the .secrets file and it is not in the git index? (In this case is the file not copied into the container and is not accessible to the workflow, also it won't be added by git add . even outside of a container)

.dockerignore isn't really used by act in most places (maybe only for legacy remote actions, and that only if it uses a Dockerfile)

<!-- gh-comment-id:1922217365 --> @ChristopherHX commented on GitHub (Feb 1, 2024): I have a question about this problem, because I don't fully understand it. Does `.gitignore` exclude the `.secrets` file and it is not in the git index? (_In this case is the file not copied into the container and is not accessible to the workflow, also it won't be added by `git add .` even outside of a container_) `.dockerignore` isn't really used by act in most places (maybe only for legacy remote actions, and that only if it uses a Dockerfile)
kerem commented 2026-03-01 21:48:24 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

I'm concerned that act has copied over the file in the first place. It isn't so much that .gitignore doesn't know not to add the file.

GitHub Actions has secrets, but it goes to great lengths not to dump them into the file system unprompted.

<!-- gh-comment-id:1922292369 --> @jsoref commented on GitHub (Feb 1, 2024): I'm concerned that `act` has copied over the file in the first place. It isn't so much that `.gitignore` doesn't know not to add the file. GitHub Actions has secrets, but it goes to great lengths _not_ to dump them into the file system unprompted.
kerem commented 2026-03-01 21:48:24 +03:00
Author
Owner
Copy link

@ChristopherHX commented on GitHub (Feb 1, 2024):

Act reads .gitignore for not copying files into the container.

Do you propose to add additional ignores hardcoded into act?

<!-- gh-comment-id:1922300872 --> @ChristopherHX commented on GitHub (Feb 1, 2024): Act reads `.gitignore` for not copying files into the container. Do you propose to add additional ignores hardcoded into act?
kerem commented 2026-03-01 21:48:24 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

If act is using .secrets, then yes.

Or at the very least, if it isn't ignored by .gitignore and was used by act, then it needs to warn that it's going to leak the file to the workspace.

<!-- gh-comment-id:1922305907 --> @jsoref commented on GitHub (Feb 1, 2024): If act is using `.secrets`, then yes. Or at the very least, if it isn't ignored by `.gitignore` and was used by act, then it needs to warn that it's going to leak the file to the workspace.
kerem commented 2026-03-01 21:48:24 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

fwiw, yes, .gitignore does keep the file out, but that isn't remotely obvious.

Heck, the fact that .secrets is automatically used isn't mentioned in any README.md or similar thing in this repository,

It's just mentioned in the help:

 % act --help|grep secrets|grep default
      --secret-file string                                file with list of secrets to read from (e.g. --secret-file .secrets) (default ".secrets")

I really really really wish it was documented in the main README.md.

<!-- gh-comment-id:1922331050 --> @jsoref commented on GitHub (Feb 1, 2024): fwiw, yes, `.gitignore` does keep the file out, but that isn't remotely obvious. Heck, the fact that `.secrets` is automatically used isn't mentioned in any `README.md` or similar thing in this repository, It's just mentioned in the help: ```sh % act --help|grep secrets|grep default --secret-file string file with list of secrets to read from (e.g. --secret-file .secrets) (default ".secrets") ``` I really really really wish it was documented in the main README.md.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

github.com/nektos/act@651e713efd/README.md (L318-L322)

<!-- gh-comment-id:1922336586 --> @jsoref commented on GitHub (Feb 1, 2024): https://github.com/nektos/act/blob/651e713efd8bb699830dd467f0423e8a5989210f/README.md?plain=1#L318-L322
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@ChristopherHX commented on GitHub (Feb 1, 2024):

Maybe early exit act if --secret-file exists, but not ignored. To accept the risk and allow running it, they need to use --allow-leaking-secret-file to opt out.

Just an idea from my side.

technically is the readme obsolete and new content should go to https://nektosact.com/ https://github.com/nektos/act-docs

<!-- gh-comment-id:1922352382 --> @ChristopherHX commented on GitHub (Feb 1, 2024): Maybe early exit act if `--secret-file` exists, but not ignored. To accept the risk and allow running it, they need to use `--allow-leaking-secret-file` to opt out. Just an idea from my side. _technically is the readme obsolete and new content should go to <https://nektosact.com/> <https://github.com/nektos/act-docs>_
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

Practically that webpage doesn't work:
image

But if it did, then the contents of the readme should be removed and replaced with "See https://nektosact.com/"

<!-- gh-comment-id:1922354886 --> @jsoref commented on GitHub (Feb 1, 2024): Practically that webpage doesn't work: <img width="1813" alt="image" src="https://github.com/nektos/act/assets/2119212/09a04908-a2d2-46b9-b69c-f4cd74faa1fd"> But if it did, then the contents of the readme should be removed and replaced with "See https://nektosact.com/"
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

Until then, the .env stuff could also be dramatically improved: github.com/jsoref/act@5f3b6bfbae

<!-- gh-comment-id:1922356477 --> @jsoref commented on GitHub (Feb 1, 2024): Until then, the `.env` stuff could also be dramatically improved: https://github.com/jsoref/act/commit/5f3b6bfbae6a7c37b608043306dcddc9da85bb50
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@ChristopherHX commented on GitHub (Feb 1, 2024):

I'm less a doc writer than you are, based on your documentation fixes across GitHub.

Practically that webpage doesn't work:

In fact these are empty pages, over in the docu sources. Both Readme and that are markdown.

I usually not writing any documentation....

Like nowhere is mentioned that:

  • --env-file env.yml
  • --secret-file secrets.yml

all accept yaml since a 3/4 year, because I somewhat don't like godotenv syntax.

<!-- gh-comment-id:1922365440 --> @ChristopherHX commented on GitHub (Feb 1, 2024): I'm less a doc writer than you are, based on your documentation fixes across GitHub. > Practically that webpage doesn't work: In fact these are empty pages, over in the docu sources. Both Readme and that are markdown. _I usually not writing any documentation...._ Like nowhere is mentioned that: - `--env-file env.yml` - `--secret-file secrets.yml` all accept yaml since a 3/4 year, because I somewhat don't like godotenv syntax.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

I'd be 💯 in favor of:

Maybe early exit act if --secret-file exists, but not ignored. To accept the risk and allow running it, they need to use --allow-leaking-secret-file to opt out.

<!-- gh-comment-id:1922366284 --> @jsoref commented on GitHub (Feb 1, 2024): I'd be 💯 in favor of: > Maybe early exit act if --secret-file exists, but not ignored. To accept the risk and allow running it, they need to use --allow-leaking-secret-file to opt out.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

I'm a coder, and can write docs, but only about things I know enough about, and within some time constraints. I'm not going to write docs from scratch. I will do minor doc fixes within reason -- as long as they're relatively cheap to do.

<!-- gh-comment-id:1922367450 --> @jsoref commented on GitHub (Feb 1, 2024): I'm a coder, and can write docs, but only about things I know enough about, and within some time constraints. I'm not going to write docs from scratch. I will do minor doc fixes within reason -- as long as they're relatively cheap to do.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

Fwiw, I landed on https://nektosact.com/ w/in the past week or two, tried to use it, decided it was mostly broken and basically discarded it.

<!-- gh-comment-id:1922368681 --> @jsoref commented on GitHub (Feb 1, 2024): Fwiw, I landed on https://nektosact.com/ w/in the past week or two, tried to use it, decided it was mostly broken and basically discarded it.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@ChristopherHX commented on GitHub (Feb 1, 2024):

yeah two important pages are empty, this should certainly be corrected. Other than that it contains information not found in the readme + has a search bar

<!-- gh-comment-id:1922374337 --> @ChristopherHX commented on GitHub (Feb 1, 2024): yeah two important pages are empty, this should certainly be corrected. Other than that it contains information not found in the readme + has a search bar
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Feb 1, 2024):

Once those two pages are fixed the readme in this repository should be truncated to have very little :)

Otherwise you're splitting focus and increasing likelihood of people not visiting the doc site.

<!-- gh-comment-id:1922385932 --> @jsoref commented on GitHub (Feb 1, 2024): Once those two pages are fixed the readme in this repository should be truncated to have very little :) Otherwise you're splitting focus and increasing likelihood of people not visiting the doc site.
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@janbrasna commented on GitHub (Mar 12, 2024):

@jsoref FYI the landing pages seem to be fixed now:

<!-- gh-comment-id:1992224978 --> @janbrasna commented on GitHub (Mar 12, 2024): @jsoref FYI the landing pages seem to be fixed now: - https://github.com/nektos/act-docs/pull/9 - https://github.com/nektos/act-docs/pull/10
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Sep 9, 2024):

Issue is stale and will be closed in 14 days unless there is new activity

<!-- gh-comment-id:2336880329 --> @github-actions[bot] commented on GitHub (Sep 9, 2024): Issue is stale and will be closed in 14 days unless there is new activity
kerem commented 2026-03-01 21:48:25 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Sep 9, 2024):

So, https://nektosact.com/usage/index.html?highlight=secret#secrets doesn't warn that the files are likely to be copied over by act.

It could suggest using .git/..., ../... or using .gitignore.

<!-- gh-comment-id:2337982094 --> @jsoref commented on GitHub (Sep 9, 2024): So, https://nektosact.com/usage/index.html?highlight=secret#secrets doesn't warn that the files are likely to be copied over by act. It could suggest using `.git/...`, `../...` or using `.gitignore`.
kerem commented 2026-03-01 21:48:26 +03:00
Author
Owner
Copy link

@github-actions[bot] commented on GitHub (Mar 26, 2025):

Issue is stale and will be closed in 14 days unless there is new activity

<!-- gh-comment-id:2752814263 --> @github-actions[bot] commented on GitHub (Mar 26, 2025): Issue is stale and will be closed in 14 days unless there is new activity
kerem commented 2026-03-01 21:48:26 +03:00
Author
Owner
Copy link

@jsoref commented on GitHub (Mar 26, 2025):

Still relevant

<!-- gh-comment-id:2752819905 --> @jsoref commented on GitHub (Mar 26, 2025): Still relevant
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
dependabot/go_modules/github.com/go-git/go-git/v5-5.18.0
dependabot/go_modules/dependencies-08815e2262
mergify/configuration-deprecated-update
dependabot/github_actions/dependencies-a3a104477f
chore/simplify-ci-and-makefile
dependabot/go_modules/golang.org/x/crypto-0.45.0
dependabot/go_modules/github.com/go-viper/mapstructure/v2-2.4.0
panekj/ci/improve-jobs
fix-skip-non-yaml-files-in-dir
normalize-pull-rebuild-flags
fix-no-recurse-by-default
2517-poor-error-for-incomplete-action-step
2472-make-use-new-action-cache-the-new-default-for-downloading-actions
act-tart
act-lxc
act-oidc
act-dind
avoid-slash-in-actor
dependabot/go_modules/github.com/docker/docker-26.1.4incompatible
meta-keep-filetime
local-repository-action-cache
pr-merger
update-docker-deps
follow_local_action_symlink
boltdb-lock-in-handler
use-socket-path
no-pull-no-rebuild
path-issues
fix/env
feat/podman
refactor/testdata
v0.2.87
v0.2.86
v0.2.85
v0.2.84
v0.2.83
v0.2.82
v0.2.81
v0.2.80
v0.2.79
v0.2.78
v0.2.77
v0.2.76
v0.2.75
v0.2.74
v0.2.73
v0.2.72
v0.2.71
v0.2.70
v0.2.69
v0.2.68
v0.2.67
v0.2.66
v0.2.65
v0.2.64
v0.2.63
v0.2.62
v0.2.61
v0.2.60
v0.2.59
v0.2.58
v0.2.57
v0.2.56
v0.2.55
v0.2.54
v0.2.53
v0.2.52
v0.2.51
v0.2.50
v0.2.49
v0.2.48
v0.2.47
v0.2.46
v0.2.45
v0.2.44
v0.2.43
v0.2.42
v0.2.41
v0.2.40
v0.2.39
v0.2.38
v0.2.37
v0.2.36
v0.2.35
v0.2.34
v0.2.33
v0.2.32
v0.2.31
v0.2.30
v0.2.29
v0.2.28
v0.2.27
v0.2.26
v0.2.25
v0.2.24
v0.2.23
v0.2.22
v0.2.21
v0.2.20
v0.2.19
v0.2.18
v0.2.17
v0.2.16
v0.2.15
v0.2.14
v0.2.13
v0.2.12
v0.2.11
v0.2.10
v0.2.9
v0.2.8
v0.2.7
v0.2.6
v0.2.5
v0.2.4
v0.2.3
v0.2.2
v0.2.1
v0.2.0
v0.1.3
v0.1.2
v0.1.1
v0.1.0
v0.0.5
v0.0.4
v0.0.3
v0.0.2
v0.0.1
Labels
Clear labels   
area/action

   
area/cli

   
area/docs

   
area/image

   
area/runner

   
area/workflow

   
backlog

   
confirmed/not-planned

   
kind/bug

   
kind/discussion

   
kind/external

   
kind/feature-request

   
kind/question

   
meta/duplicate

   
meta/invalid

   
meta/need-more-info

   
meta/resolved

   
meta/wontfix

   
meta/workaround

   
needs-work

   
pull-request

Mirrored from GitHub Pull Request

  
review/not-planned

   
size/M

   
size/XL

   
size/XXL

   
stale

   
stale-exempt
No labels
area/action
area/cli
area/docs
area/image
area/runner
area/workflow
backlog
confirmed/not-planned
kind/bug
kind/discussion
kind/external
kind/feature-request
kind/question
meta/duplicate
meta/invalid
meta/need-more-info
meta/resolved
meta/wontfix
meta/workaround
needs-work
pull-request
review/not-planned
size/M
size/XL
size/XXL
stale
stale-exempt
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/act#1038
No description provided.