github / github/vscode-github-actions

false positive error on `secrets` context access in forks

Open
#375 3 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
660
Forks
213
PR merge metrics
No merged PRs in 30d

Description

For a workflow that accesses secrets:

```yml
- name: "publish npm"
uses: "./.github/actions/publish-npm"
env:
NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
```

The extension is very helpful in checking if the secret `NPM_TOKEN` is actually defined or not.
However, it only checks secrets defined in the same repository (I suspect `origin` remote), and reports a false-positive error if it was defined in `upstream`, and `origin` is actually pointing to a fork:

> Context access might be invalid: NPM_TOKEN

**Expected behavior**

All remotes to be checked for secrets, not just `origin`, and the error is no longer reported.

**Screenshots**

image

**Extension Version**
`v0.26.3`

Contributor guide

Open the contributing guide

Research direction

Start by locating the extension's validation of GitHub Actions secrets and how it determines the repository or remotes to inspect. Reproduce the fork-and-upstream scenario described in the issue, then verify that a secret defined upstream no longer produces a false-positive context-access error.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, typescript, vscode
Domain
ci-cd, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.