actions-state-and-secrets

To pass secrets between GitHub Action phases, you persist state across phase boundaries using typed schemas and the GITHUB_STATE interface. This ensures sensitive data handoffs between pre, main, and post steps remain structurally validated and secure.

GitHub Actions log redaction for masked state variables works by automatically applying masking to secrets before the values are persisted or logged. This prevents accidental exposure of sensitive information like temporary tokens in workflow execution outputs.

The best way to persist sensitive data across CI/CD workflow steps is using a BlobEnvelope format to frame cached payloads with versioned metadata. This ensures safe, structured storage and reliable state handoffs between execution phases.

Yes, you can use typed schemas to validate GitHub Action state between execution phases. This approach satisfies strict security requirements for log redaction and ensures the structural validation of persisted process data during complex CI/CD workflows.

Temporary tokens leak in GitHub Actions workflow logs when persisting state without automated masking. Applying secret masking before values are persisted or logged prevents this accidental exposure during data handoffs between action phases.