> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GH_CanAccessSecret

> [Computed] Workflow job execution context can access a statically referenced secret — GH_WorkflowJob → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=ad49a576589f4d2a8081df77d07fdf56" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Edge Schema

* Traversable: ✅

| Start                                                                | Kind                | End                                                                              |
| -------------------------------------------------------------------- | ------------------- | -------------------------------------------------------------------------------- |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | GH\_CanAccessSecret | [GH\_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret)               |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | GH\_CanAccessSecret | [GH\_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret)                 |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | GH\_CanAccessSecret | [GH\_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) |

```mermaid theme={null}
flowchart LR
    GH_EnvironmentSecret["GH_EnvironmentSecret"]
    GH_OrgSecret["GH_OrgSecret"]
    GH_RepoSecret["GH_RepoSecret"]
    GH_WorkflowJob["GH_WorkflowJob"]
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_EnvironmentSecret
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_OrgSecret
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_RepoSecret
```

## General Information

The traversable GH\_CanAccessSecret edge represents that a GitHub Actions workflow job execution context can access a statically referenced secret.

This edge is derived from the existing non-traversable [GH\_UsesSecret](/opengraph/extensions/github/edges/gh_usessecret) relationships on the job's contained steps and from job-level `env` declarations. It is intended for attack-path analysis from a compromised job execution context to the secrets that context can read.

The collector only emits this edge when one of the workflow job's modeled steps or the job's `env` block statically references the secret. The existence of a secret in the repository, organization, or environment scope alone is not enough. For this initial implementation, secrets passed through `jobs.<job_id>.secrets` to reusable workflows are retained as structural references but are not projected as runtime access for the caller job.

## Edge Schema

| Source                                                               | Destination                                                                      | Traversable |
| -------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ----------- |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | [GH\_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret) | `true`      |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | [GH\_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret)                 | `true`      |
| [GH\_WorkflowJob](/opengraph/extensions/github/nodes/gh_workflowjob) | [GH\_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret)               | `true`      |

## Diagram

```mermaid theme={null}
graph LR
    n0["GH_WorkflowJob"]
    n1["GH_EnvironmentSecret"]
    n2["GH_OrgSecret"]
    n3["GH_RepoSecret"]
    n0 -->|GH_CanAccessSecret| n1
    n0 -->|GH_CanAccessSecret| n2
    n0 -->|GH_CanAccessSecret| n3
```