Secret scanning now checks GitHub Actions workflow logs

What changed

Scanning runs when a workflow run completes, and findings land in the repository’s normal secret scanning alert list. GitHub says each alert links back to the workflow log, validity checks run for supported secret types, and alerts remain even after the logs are deleted.

Agents that run commands in CI can print tokens by accident, which is where a log check helps.

How to turn it on

The preview is for enterprises on GitHub Enterprise Cloud with GitHub Secret Protection or GitHub Advanced Security, including data residency on GHE.com. The policy is disabled by default. Enterprise owners can enable it under enterprise settings, Policies, Advanced Security, by selecting Enabled in the All repositories dropdown.

It applies only to repositories that already have secret scanning enabled under those licenses.

Limits to know

• Only workflow runs that finish after you enable it are scanned, and existing logs are not backfilled.
• Generic patterns, custom patterns, AI-detected secrets and secrets already masked by Actions are not detected.
• Alerts from workflow logs send no notifications during the preview, so check the repository’s secret scanning alert list yourself.

What to do

1. Enterprise owners. Enable the policy for the repositories that run agent or deploy workflows.
2. Add a recurring look at the alert list, since nothing will ping you.
3. Rotate any secret an alert flags before you do anything else.