Trusted Data Apps for the Agentic Data Cloud, powered by Looker
cloud.google.com·7h ago
Software Engineering
Rust Blog·21d ago·5 min read
GitHub Actions leaking secrets when Miri output is cached
TL;DR
Miri, a Rust tool, was found to cache environment variables, potentially leaking secrets in GitHub Actions. A fix is being implemented to limit cached variables and enhance security.
✦ Why It Matters
Review your GitHub Actions configurations to prevent secret leaks from cached environments.
Key Takeaways
- Limit cached environment variables to CARGO_ and OUT_DIR.
- Clear existing caches to mitigate potential leaks.
- Rotate any secrets that may have been exposed.
- Review CI configurations to ensure secrets are not accessible.
How It Works
Miri retains build-relevant environment variables by storing them in the target directory. When this directory is cached in GitHub Actions, it can expose sensitive information to PRs, as these can read from the cache.