Skip to main content
Applies to BloodHound Enterprise and CE

Edge Schema

General Information

The traversable GH_UsesSecret edge links a workflow step to the secret it references via a ${{ secrets.NAME }} expression. This edge reveals which secrets a step can access at runtime, enabling analysts to trace the blast radius of a compromised workflow.

Matching strategy

Edges use match_by: property with two matchers to disambiguate between secrets with the same name across repositories: This means one ${{ secrets.MY_SECRET }} expression in a workflow can produce up to two GH_UsesSecret edges.

Context property

The edge carries a context property indicating where the reference was found:
  • with — inside a with: input block of a uses: action step
  • env — inside the step’s env: block
  • run — inline within a run: shell script