Edge Schema
- Source: GH_WorkflowStep
- Destination: GH_RepoSecret, GH_OrgSecret
- Traversable: ❌
General Information
The traversable GH_UsesSecret edge links a workflow step to the secret it references via a${{ secrets.NAME }} expression. This edge reveals which secrets a step can access at runtime, enabling analysts to trace the blast radius of a compromised workflow.
Matching strategy
Edges usematch_by: property with two matchers to disambiguate between secrets with the same name across repositories:
- GH_RepoSecret is matched by
name+repository_id. - GH_OrgSecret is matched by
name+environmentid.
${{ secrets.MY_SECRET }} expression in a workflow can produce up to two GH_UsesSecret edges.
Context property
The edge carries acontext property indicating where the reference was found:
with— inside awith:input block of auses:action stepenv— inside the step’senv:blockrun— inline within arun:shell script