Github has a functionality called "Secrets" made for GitHub Actions (which is their CI).

These secrets are easy to read from the CI. You can do it like this,

env: # Or as an environment variable
  super_secret: ${{ secrets.SuperSecret }}

And then the runner can do anything with them. But it seems weird if they're that easy to get to a runner, that it's impossible to get them out without a runner.

You can set them in the back of GitHub, or with gh the GitHub CLI tool. Is it possible to read the value of a GitHub Actions Secrets without intentionally leaking them from a runner.

A follow up to this question How can I easily leak secrets with GitHub Actions?

1 Answer 1



It's not currently possible to view the value of the secret without leaking the secret, which is easy enough.

There is a ticket for this functionality in the CLI, and it was closed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.