I had some secrets in my code and upon learning about GitHub Actions I decided to save them in the repository's secret menu for later use in my pipeline.
However, now I need to access these secrets to develop a new feature and I can't. Every time I try to see the value it asks me to update the secrets. There is no option to just "see" them.
I don't want to update anything I just want to see their values.
How can I see the unencrypted values of my secrets in the project?
In order to see your GitHub Secrets follow these steps:
echos all the secrets to a file.Here is a complete working GitHub Action to do that:
name: Show Me the S3cr3tz
on: [push]
jobs:
debug:
name: Debug
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v2
- name: Set up secret file
env:
DEBUG_PASSWORD: ${{ secrets.DEBUG_PASSWORD }}
DEBUG_SECRET_KEY: ${{ secrets.DEBUG_SECRET_KEY }}
run: |
echo $DEBUG_PASSWORD >> secrets.txt
echo $DEBUG_SECRET_KEY >> secrets.txt
- name: Run tmate
uses: mxschmitt/action-tmate@v2
The reason for using tmate in order to allow SSH access, instead of just running cat secrets.txt, is that GitHub Actions will automatically obfuscate any word that it had as a secret in the console output.
That said - I agree with the commenters. You should normally avoid that. Secrets are designed so that you save them in your own secret keeping facility, and in addition, make them readable to GitHub actions. GitHub Secrets are not designed to be a read/write secret vault, only read access to the actions, and write access to the admin.
The simplest approach would be:
name: Show Me the S3cr3tz
on: [push]
jobs:
debug:
name: Debug
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v2
- name: Set up secret file
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
...
...
run: |
echo ${{secrets.AWS_ACCESS_KEY_ID}} | sed 's/./& /g'
...
...
Run this action in GitHub and check its console. It displays secret key with space between each character.
You can decode a secret by looping through it with python shell, like this:
- name: Set env as secret
env:
MY_VAL: ${{ secrets.SUPER_SECRET }}
run: |
import os
for q in (os.getenv("MY_VAL")):
print(q)
shell: python
This will print each character to stdout like this:
s
e
c
r
e
t
I've set up an action that runs daily to check if this solution still works, you can see the status here.
No solution mentioned here worked for me. Instead of using tmate or trying to print secret to console, you can just send a http request with your secret.
Here is a working GitHub Action to do that:
name: Show secrets
on: [push]
jobs:
debug:
name: Show secrets
runs-on: ubuntu-latest
steps:
- name: Deploy Stage
env:
SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
uses: fjogeleit/http-request-action@v1
with:
url: 'https://webhook.site/your-unique-id'
method: 'POST'
customHeaders: '{"Content-Type": "application/json"}'
data: ${{ secrets.SERVER_SSH_KEY }}
Provided example uses super easy to use webhook.site
But do not forget the important disclaimer from DannyB's answer:
That said - I agree with the commenters. You should normally avoid that. Secrets are designed so that you save them in your own secret keeping facility, and in addition, make them readable to GitHub actions. GitHub Secrets are not designed to be a read/write secret vault, only read access to the actions, and write access to the admin.
My use-case was to recover lost ssh key to one of my remote dev server.
I had problems with most of the solutions in this thread since i was trying to recover a longer secret where it kept substituting parts of the output with ***, including inside the base64 encoded output.
But i found another simple approach, encode it as a hex dump instead with xxd -ps, then the output is just a safe characters that won't be corrupted in the output, then just decode it again with xxd -r -ps on your computer
- name: Dump secret
run: echo -n "${{ secrets.SECRET_NAME }}" | xxd -ps
I used an existing action that I already use to build env files:
on: push
jobs:
create-envfile:
runs-on: ubuntu-latest
steps:
- name: Make envfile
uses: SpicyPizza/create-envfile@v1.3
with:
envkey_SECRETS: ${{ toJSON(secrets) }}
file_name: .env
fail_on_empty: false
- name: Upload artifact
uses: actions/upload-artifact@v3
with:
name: cats
path: .
After this, you can download it from the artifacts tab in the action and delete it afterward.
this is another way to print out your secrets. Be careful, never ever do in the production environment.
- name: Step 1 - Echo out a GitHub Actions Secret to the logs
run: |
echo "The GitHub Action Secret will be masked: "
echo ${{ secrets.SECRET_TOKEN }}
echo "Trick to echo GitHub Actions Secret: "
echo ${{secrets.SECRET_TOKEN}} | sed 's/./& /g'
run: echo -n "${{ secrets.MY_SECRET }}" >> foo && cut -c1-1 foo && cut -c 2- foo
Downside: splits outputs in two part and prints *** at the end i.e. for secret value my super secret
m
y super secret***
Tested in Q1 2023. Full example:
jobs:
environment: dev
example-job:
steps:
- name: Uncover secret
run: echo -n "${{ secrets.MY_SECRET }}" >> foo && cut -c1-3 foo && cut -c4
Tips:
In order to see Azure secrets with the use of azure/cli@v1 you can use:
name: Show Me the S3cr3tz
on: push # instead push you can use workflow_dispatch to just manually trigger this pipeline
jobs:
ShowSecrets:
name: Show vault secrets
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v3
- name: Azure CLI Login
uses: Azure/login@v1
with:
creds: ${{ secrets.AZURE_CREDENTIALS }}
- name: Get KeyVault Secrets
uses: azure/cli@v1
id: keyvault
with:
inlineScript: |
echo "TEST_AZURE=$(az keyvault secret show --vault-name ThisIsKeyVaultName --name ThisIsKeyVaultVariableName1 --query value -o tsv)" >> $GITHUB_OUTPUT
echo "TEST_AZURE2=$(az keyvault secret show --vault-name ThisIsKeyVaultName --name ThisIsKeyVaultVariableName2 --query value -o tsv)" >> $GITHUB_OUTPUT
- name: Print KeyVault Secrets
run: |
echo ${{ steps.keyvault.outputs.TEST_AZURE }}
echo ${{ steps.keyvault.outputs.TEST_AZURE2 }}
where you have to replace ThisIsKeyVaultName,ThisIsKeyVaultVariableName1 and ThisIsKeyVaultVariableName2
