Answers: <h1>No</h1>
  <p>It's not currently possible to view the value of the secret without leaking the secret, which is easy enough.</p>
  <p>There is a <a href="https://github.com/cli/cli/discussions/3397" rel="nofollow noreferrer">ticket for this functionality in the CLI, and it was closed.</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-07T21:12:41.073Z
Answers: 2024-02-13T16:14:31.170Z
Answers: 2024-02-13T16:14:31.170Z
Answers: Evan Carroll
Body: <p>Github has a functionality called <a href="https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions" rel="nofollow noreferrer">&quot;Secrets&quot; made for GitHub Actions</a> (which is their CI).</p>
  <p>These secrets are easy to read from the CI. You can do it like this,</p>
  <pre><code>env: # Or as an environment variable
    super_secret: ${{ secrets.SuperSecret }}
  </code></pre>
  <p>And then the runner can do anything with them. But it seems weird if they're that easy to get to a runner, that it's impossible to get them out without a runner.</p>
  <p>You can set them in the <a href="https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions?tool=webui" rel="nofollow noreferrer">back of GitHub</a>, or with <a href="https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions?tool=cli" rel="nofollow noreferrer"><code>gh</code> the GitHub CLI tool</a>. Is it possible to read the value of a GitHub Actions Secrets without intentionally leaking them from a runner.</p>
  <hr />
  <p>A follow up to this question <a href="https://devops.stackexchange.com/q/18901/18965">How can I easily leak secrets with GitHub Actions?</a></p>
  
Tags: <github><github-actions><secret-management>
Title: How can you retrieve (read) GitHub secrets without invoking CI?
UserDisplayName: Evan Carroll
ThreadText: # How can you retrieve (read) GitHub secrets without invoking CI?
  
  (Asked by: username_0 on 2024-02-07)
  
  Github has a functionality called ["Secrets" made for GitHub Actions](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions) (which is their CI).
  
  These secrets are easy to read from the CI. You can do it like this,
  
  ```
  env: # Or as an environment variable
    super_secret: ${{ secrets.SuperSecret }}
  
  ```
  
  And then the runner can do anything with them. But it seems weird if they're that easy to get to a runner, that it's impossible to get them out without a runner.
  
  You can set them in the [back of GitHub](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions?tool=webui), or with [`gh` the GitHub CLI tool](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions?tool=cli). Is it possible to read the value of a GitHub Actions Secrets without intentionally leaking them from a runner.
  
  ---
  
  A follow up to this question [How can I easily leak secrets with GitHub Actions?](https://devops.stackexchange.com/q/18901/18965)
  
  **Tags:** github, github-actions, secret-management
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-02-07. Score: 0 | Accepted answer
  
  # No
  
  It's not currently possible to view the value of the secret without leaking the secret, which is easy enough.
  
  There is a [ticket for this functionality in the CLI, and it was closed.](https://github.com/cli/cli/discussions/3397)
  
  
  ---
  
  