Skip to content

refactor:[M3-9877][SECURITY] - Fix excessive secrets exposure warning in e2e GHA workflow - #12664

Merged
bill-akamai merged 4 commits into
linode:developfrom
bill-akamai:M3-9877
Aug 13, 2025
Merged

refactor:[M3-9877][SECURITY] - Fix excessive secrets exposure warning in e2e GHA workflow#12664
bill-akamai merged 4 commits into
linode:developfrom
bill-akamai:M3-9877

Conversation

@bill-akamai

@bill-akamai bill-akamai commented Aug 8, 2025

Copy link
Copy Markdown
Contributor

Description 📝

This PR fixes the Excessive Secrets Exposure vulnerability in our E2E GitHub Actions workflow to stop using dynamic secret lookups and instead use env variables scoped to each matrix job.

Changes 🔄

  • Replaced dynamic secret access (secrets[matrix.user.name]) with env-based access (env[matrix.user.name]) for MANAGER_OAUTH in .github/workflows/e2e_schedule_and_push.yml

Scope 🚢

Upon production release, changes in this PR will be visible to:

  • All customers
  • Some customers (e.g. in Beta or Limited Availability)
  • No customers / Not applicable

Verification steps

Full verification will need to be done after merging. In the meantime, I was able to partially verify in my forked repo by adding a copy of the .github/workflows/e2e_schedule_and_push.yml file with my change as this debug Action in GitHub. I added secrets for USER_1 and USER_2 in my repo and could see that they're logging a masked value with the new format of env[matrix.user.name]. I ran my repo's CodeQL Action and saw it only logs an Excessive Secrets Exposure issue for the existing .github/workflows/e2e_schedule_and_push.yml and not the new debug version as expected. IRL, we can verify post-merge as follows:

Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support


  • I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

  • All tests and CI checks are passing
  • TypeScript compilation succeeded without errors
  • Code passes all linting rules

@bill-akamai bill-akamai self-assigned this Aug 8, 2025
@bill-akamai bill-akamai added the Security Pull requests that address a security vulnerability label Aug 8, 2025
@bill-akamai
bill-akamai marked this pull request as ready for review August 11, 2025 17:23
@bill-akamai
bill-akamai requested a review from a team as a code owner August 11, 2025 17:23
@bill-akamai
bill-akamai requested review from bnussman-akamai and harsh-akamai and removed request for a team August 11, 2025 17:23
@linode-gh-bot

Copy link
Copy Markdown

Cloud Manager UI test results

🔺 2 failing tests on test run #2 ↗︎

❌ Failing✅ Passing↪️ Skipped🕐 Duration
2 Failing703 Passing4 Skipped127m 11s

Details

Failing Tests
SpecTest
linode-storage.spec.tsCloud Manager Cypress Tests→linode storage tab » delete disk
restricted-user-details-pages.spec.tsCloud Manager Cypress Tests→restricted user details pages » should disable action elements and buttons in the 'Linodes' details page

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/linodes/linode-storage.spec.ts,cypress/e2e/core/account/restricted-user-details-pages.spec.ts"

@bnussman-akamai bnussman-akamai left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will verify once merged!

@github-project-automation github-project-automation Bot moved this from Review to Approved in Cloud Manager Aug 13, 2025
@bill-akamai
bill-akamai merged commit 2d6645f into linode:develop Aug 13, 2025
34 of 35 checks passed
@github-project-automation github-project-automation Bot moved this from Approved to Merged in Cloud Manager Aug 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Security Pull requests that address a security vulnerability

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants