actions-state-and-secrets

Persist state and secrets across GitHub Action phases with typed schemas and masking.

2|Updated Jul 2, 2026

Search Tags:#security #state-management #github-actions #ci-cd #redaction #effect

Ready to run

npx skills add https://github.com/spencerbeggs/effected --skill actions-state-and-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: actions-state-and-secrets
Source: https://github.com/spencerbeggs/effected/tree/main/plugin/skills/actions-state-and-secrets
Command: npx skills add https://github.com/spencerbeggs/effected --skill actions-state-and-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of safely persisting data across GitHub Action phase boundaries (pre, main, post) while ensuring sensitive information is masked and never leaked in logs.

Core Features & Use Cases

Phase-Boundary Persistence: Reliably pass state between action phases using typed schemas and GITHUB_STATE.
Secret Masking: Automatically mask secrets before they are persisted or logged, preventing accidental exposure.
Blob Framing: Use the BlobEnvelope format to add versioned metadata to cached payloads, ensuring safe and structured storage.
Use Case: When building a custom GitHub Action that provisions a temporary token in the pre-phase, use this skill to save the secret securely so the main phase can consume it without exposing the value in workflow logs.

Quick Start

Use the actions-state-and-secrets skill to save a sensitive configuration value across action phases while ensuring it is automatically masked from logs.

Frequently Asked Questions about actions-state-and-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I pass secrets between GitHub Actions pre and post execution phases?▼

To pass secrets between GitHub Action phases, you persist state across phase boundaries using typed schemas and the GITHUB_STATE interface. This ensures sensitive data handoffs between pre, main, and post steps remain structurally validated and secure.

How does GitHub Actions log redaction work for masked state variables?▼

GitHub Actions log redaction for masked state variables works by automatically applying masking to secrets before the values are persisted or logged. This prevents accidental exposure of sensitive information like temporary tokens in workflow execution outputs.

What is the best way to persist sensitive data across CI/CD workflow steps?▼

The best way to persist sensitive data across CI/CD workflow steps is using a BlobEnvelope format to frame cached payloads with versioned metadata. This ensures safe, structured storage and reliable state handoffs between execution phases.

Can I use typed schemas to validate GitHub Action state between execution phases?▼

Yes, you can use typed schemas to validate GitHub Action state between execution phases. This approach satisfies strict security requirements for log redaction and ensures the structural validation of persisted process data during complex CI/CD workflows.

Why are my temporary tokens leaking in GitHub Actions workflow logs?▼

Temporary tokens leak in GitHub Actions workflow logs when persisting state without automated masking. Applying secret masking before values are persisted or logged prevents this accidental exposure during data handoffs between action phases.