Function extractSecretsFromStepValue

pkg/workflow/strict_mode_steps_validation.go:196–213

extractSecretsFromStepValue recursively walks a step value (which may be a map, slice, or primitive) and returns all secrets.* expressions found in string values.

(value any)

// extractSecretsFromStepValue recursively walks a step value (which may be a map,
// slice, or primitive) and returns all secrets.* expressions found in string values.
func extractSecretsFromStepValue(value any) []string {
	var refs []string
	switch v := value.(type) {
	case string:
		for _, expr := range ExtractSecretsFromValue(v) {
			refs = append(refs, expr)
		}
	case map[string]any:
		for _, fieldValue := range v {
			refs = append(refs, extractSecretsFromStepValue(fieldValue)...)
		}
	case []any:
		for _, item := range v {
			refs = append(refs, extractSecretsFromStepValue(item)...)
		}
	}
	return refs
}

// filterBuiltinTokens removes secret expressions that reference *only* GitHub's
// built-in GITHUB_TOKEN from the list. GITHUB_TOKEN is automatically provided by