Secret Value is visible for the first time creation

[yaswanth-badam]

Hello,

Secret Value is visible to eye for the 1st time creation. Is there any possibility to mask the secret value for the 1st time creation also?

Please share the best practices how to mask the secret value even for first time creation?

Thanks

[nirav-gajera]

You can do this by using the ::add-mask:: command in a GitHub Actions workflow. This command will mask the secret value with asterisks (*).

name: Mask secret value

on:
  push:
    branches:
      - main

jobs:
  MaskSecret:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Mask secret value
        run: echo ::add-mask:: ${{ secrets.SECRET_KEY }}

Once you have added the ::add-mask:: command to your workflow, you will not be able to see the secret value in plain text.

or: INJECTED_ENV_VAR: ${{secrets[github.event.inputs.injectedEnvVar]}}

[yaswanth-badam]

Hello @nirav-gajera ,

Thanks for your response.

Im looking for 1st time creation,

steps:

1: github settings
2: secret and variables
3: click on new repository secret
4: enter secret name
5: enter secret value (here the value is visible for 1st time)

Now the question is, how can I mask the secret value while creating the 1st time.

Thanks

[nirav-gajera]

Ah, You cannot mask the secret value while creating it for the first time. The secret value is only masked after it has been created.

However, you can use a third-party tool to mask the secret value before you enter it into GitHub. For example, you could use a password manager or a hardware security module.

Once you have masked the secret value, you can copy and paste it into the GitHub secret creation form. The secret value will still be masked when you enter it into the form.

some third-party tools that you can use to mask secret values:

• 1Password: https://1password.com/
• LastPass: https://lastpass.com/
• Dashlane: https://dashlane.com/
• Keeper: https://keepersecurity.com/
• Troy Hunt's Have I Been Pwned?: https://haveibeenpwned.com/