secrets-without-environment.yaml

# NOTE: this rule assumes ${{ secrets.SECRET }} is NEVER passed inside 'run' blocks
#       Meaning the rule ./shell-script-injection.yaml is being used & respected.
rules:
  - id: secrets-without-environment-in-env-block
    message: >
      This GitHub Actions workflow uses secrets but does not configure a job-level
      environment. Secrets should be scoped to a GitHub Environment to enforce
      protection rules (reviewers, deployment gates, etc) and to reduce blast radius.
    severity: WARNING
    languages: [yaml]
    metadata:
      category: security
      technology: github-actions
      cwe: "CWE-522: Insufficiently Protected Credentials"
      likelihood: MEDIUM
      confidence: HIGH
      impact: HIGH

    patterns:
      - pattern-inside: |
          steps: [...]
      - pattern-inside: |
          env: ...
          ...
      - pattern: |
          env: $X
      - metavariable-pattern:
          language: generic
          metavariable: $X
          patterns:
            - pattern: "${{ secrets.$SECRET }}"
            # GITHUB_TOKEN can be OK without environment as it's a dynamic secret
            - pattern-not: "${{ secrets.GITHUB_TOKEN }}"
      # Exclude jobs that properly define an environment
      - pattern-not-inside: |
          jobs:
            ...
            $JOB:
              ...
              environment:
                ...
      - focus-metavariable: $SECRET
  - id: secrets-without-environment-in-with-block
    message: >
      This GitHub Actions workflow uses secrets but does not configure a job-level
      environment. Secrets should be scoped to a GitHub Environment to enforce
      protection rules (reviewers, deployment gates, etc) and to reduce blast radius.
    severity: WARNING
    languages: [yaml]
    metadata:
      category: security
      technology: github-actions
      cwe: "CWE-522: Insufficiently Protected Credentials"
      confidence: medium

    patterns:
      - pattern-inside: |
          steps: [...]
      - pattern-inside: |
          with: ...
          ...
      - pattern: |
          with: $X
      - metavariable-pattern:
          language: generic
          metavariable: $X
          patterns:
            - pattern: "${{ secrets.$SECRET }}"
            - pattern-not: "${{ secrets.GITHUB_TOKEN }}"
      # GITHUB_TOKEN can be OK without environment as it's a dynamic secret
      - pattern-not-inside: |
          jobs:
            ...
            $JOB:
              ...
              environment:
                ...
      - focus-metavariable: $SECRET