Secret scanning detects secrets in GitHub Actions workflow logs

GitHub secret scanning now detects secrets in Actions workflow logs, in public preview. It already covers issues, wikis, discussions, and pull requests.

Once a workflow run completes, GitHub scans its logs for provider patterns. Findings show up in the repository's secret scanning alert list next to alerts from code and other content. Each alert links to the workflow file where the secret came from and the log line where it was printed, with no inline preview of the log content. Validity checks run for supported secret types, and alerts stay available after the logs are deleted.

Enterprise owners turn it on under enterprise settings, Policies, then Advanced Security, by choosing Enabled in the All repositories dropdown. The preview is for GitHub Enterprise Cloud enterprises with GitHub Secret Protection or GitHub Advanced Security, including GHE.com data residency. It's off by default and only applies to repositories that already have secret scanning enabled.

A few limits to know about: only runs that finish after you enable it are scanned, so past logs aren't backfilled. It doesn't catch generic patterns, custom patterns, AI-detected secrets, or values Actions has already masked. Alerts from workflow logs don't send notifications during the preview, so you'll need to check the secret scanning alerts list yourself.