Function ExtractSecretsFromValue

pkg/workflow/secret_extraction.go:48–74

ExtractSecretsFromValue extracts all GitHub Actions secret expressions from a string value Returns a map of environment variable names to their full secret expressions This function detects secrets in both simple expressions and sub-expressions: Examples: - "${{ secrets.DD_API_KEY }}" -> {"DD_API_KE

(value string)

//   - "${{ github.workflow && secrets.TOKEN }}" -> {"TOKEN": "${{ github.workflow && secrets.TOKEN }}"}
//   - "${{ (github.actor || secrets.HIDDEN) }}" -> {"HIDDEN": "${{ (github.actor || secrets.HIDDEN) }}"}
func ExtractSecretsFromValue(value string) map[string]string {
	secrets := make(map[string]string)

	// Find all ${{ ... }} expressions in the value
	// Pattern matches from ${{ to }} allowing nested content
	expressions := InlineExpressionPattern.FindAllString(value, -1)

	// For each expression, check if it contains secrets.VARIABLE_NAME
	// This handles both simple cases like "${{ secrets.TOKEN }}"
	// and complex sub-expressions like "${{ github.workflow && secrets.TOKEN }}"
	for _, expr := range expressions {
		matches := secretsNamePattern.FindAllStringSubmatch(expr, -1)
		for _, match := range matches {
			if len(match) >= 2 {
				varName := match[1]
				// Store the full expression that contains this secret
				secrets[varName] = expr
				secretLog.Printf("Extracted secret: %s from expression: %s", varName, expr)
			}
		}
	}

	if len(secrets) > 0 {
		secretLog.Printf("Extracted %d secrets from value", len(secrets))
	}
	return secrets
}

// ExtractSecretsFromMap extracts all secrets from a map of string values
// Returns a map of environment variable names to their full secret expressions