From 03bf98cde309a16ae8e6ead5ddce075e5ac3ca65 Mon Sep 17 00:00:00 2001
From: Varun Sharma <varunsh@stepsecurity.io>
Date: Tue, 23 Jul 2024 17:36:01 -0700
Subject: [PATCH] Create secret-in-build-log.yml

---
 .github/workflows/secret-in-build-log.yml | 33 +++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/secret-in-build-log.yml

diff --git a/.github/workflows/secret-in-build-log.yml b/.github/workflows/secret-in-build-log.yml
new file mode 100644
index 00000000..847c1ca1
--- /dev/null
+++ b/.github/workflows/secret-in-build-log.yml
@@ -0,0 +1,33 @@
+name: Secret in Build Log
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      
+      - name: harden-runner
+        uses: step-security/harden-runner@v2
+        with: 
+          egress-policy: audit
+
+      - name: Extract and use GCP private key
+        env:
+          GCP_SERVICE_ACCOUNT_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
+        run: |
+          # Extracting the private key from the GCP service account key
+          PRIVATE_KEY=$(echo $GCP_SERVICE_ACCOUNT_KEY | jq -r '.private_key')
+          
+          # Simulate using the private key
+          echo "Using the private key for some operation"
+          
+          # Log the private key (simulating a mistake)
+          echo "GCP Private Key: $PRIVATE_KEY"
+
+      - name: Run a script
+        run: |
+          sleep 2