secret-scan-b.json

{
  "name": "secret-scan-b",
  "pair": "secret-scan",
  "phase": "B",
  "description": "Fix a GitHub Actions workflow that exposes a secret in logs.",
  "setup": {
    "repo_state": "workflow with echo ${{ secrets.API_KEY }} in run step",
    "ci_state": "secret masked in logs but workflow fails downstream",
    "error_message": "Error: Input required and not supplied: api_key",
    "lesson_pool_available": true,
    "relevant_lesson": "github-api-pr-issue-management"
  },
  "expected_outcome": {
    "retrieves_lesson": true,
    "avoids_dead_end": "don't hardcode the secret as fallback",
    "fix_approach": "use env: block instead of inline interpolation, or use secrets manager",
    "lesson_generated": false
  },
  "validation": {
    "searched_misakanet": true,
    "found_token_lesson": true,
    "fix_doesnt_expose_secret": true
  },
  "measures": "Whether agent applies secret-handling pattern from prior lesson"
}