If a secret in actions has a value similar to other secrets, subsequent secrets or variables will be overwritten. #14334

New Issue

GiteaMirror · 2025-11-02T11:10:06-06:00

GiteaMirror commented

2025-11-02 11:10:06 -06:00

Originally created by @Updates-Unihoster on GitHub (Apr 3, 2025).

Description

If a secret in actions has a value similar to other secrets, subsequent secrets or variables will be overwritten.
How to reproduce:

Create empty repo and init it.
Create secret (name not meters but in my case it named "LOKI_USER") and set its value as, for example "loki"
Create another secret, (name not meters but in my case it named "LOKI_PASSWORD") and set its value similar but not exactly like in step 2. So in my case it will be supersecretlokipassword (word contain the "loki" string)
Create gitea actions CI\CD in order not to describe each step, I just provide a simple example when the bug is reproduced.

name: Prod CI/CD
on:
  push:
    branches:
      - 'master'

jobs:
  Prod-Build-Deploy:
    runs-on: ubuntu-latest
    steps:
      -
        name: Check out repository code
        uses: actions/checkout@v4
      -
        name: Print secret and var
        run: |
          echo "LOKI user var: ${{ vars.LOKI_USER }}"
          echo "LOKI user secret: ${{ secrets.LOKI_USER }}"
          echo "LOKI password var: ${{ vars.LOKI_PASSWORD }}"
          echo "LOKI password secret: ${{ secrets.LOKI_PASSWORD }}"

Commit your ci\cd and see output of step named "Print secret and var". You will see something like this:

If you delete for example variables and leave only secrets and change value of secret from "supersecretlokipassword" to for example json format "supersecret.loki.password" (dots added) you will see that now not the entire line is replaced, but only part of it:

Its seems like very hard to find bug i literally spend days to find what happens to my secrets and why it turn to "****". Only works with case sensitive secrets, so if you try to set LOKI_USER as "LOKI" and do not change password and leave it as "supersecretlokipassword" - nothing happens to it.

Version of gitea what i running (but also bug reproduces in older 1.23+ versions):
Latest ([1.23.6])

Gitea Version

1.23.6

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

2.43.0

Operating System

Ubuntu 24.04

How are you running Gitea?

Running as systemd service but i think its core gitea bug so you can reproduce this behavior no matter how you run gitea

Database

MySQL/MariaDB

Originally created by @Updates-Unihoster on GitHub (Apr 3, 2025). ### Description If a secret in actions has a value similar to other secrets, subsequent secrets or variables will be overwritten. How to reproduce: 1. Create empty repo and init it. 2. Create secret (name not meters but in my case it named "LOKI_USER") and set its value as, for example "loki" 3. Create another secret, (name not meters but in my case it named "LOKI_PASSWORD") and set its value similar but not exactly like in step 2. So in my case it will be supersecretlokipassword (word contain the "loki" string) 4. Create gitea actions CI\CD in order not to describe each step, I just provide a simple example when the bug is reproduced. ```yaml name: Prod CI/CD on: push: branches: - 'master' jobs: Prod-Build-Deploy: runs-on: ubuntu-latest steps: - name: Check out repository code uses: actions/checkout@v4 - name: Print secret and var run: | echo "LOKI user var: ${{ vars.LOKI_USER }}" echo "LOKI user secret: ${{ secrets.LOKI_USER }}" echo "LOKI password var: ${{ vars.LOKI_PASSWORD }}" echo "LOKI password secret: ${{ secrets.LOKI_PASSWORD }}" ``` 5. Commit your ci\cd and see output of step named "Print secret and var". You will see something like this: ![Image](https://github.com/user-attachments/assets/b331fb11-467e-43b1-ad29-47c6c651d7dc) 6. If you delete for example variables and leave only secrets and change value of secret from "supersecretlokipassword" to for example json format "supersecret.loki.password" (dots added) you will see that now not the entire line is replaced, but only part of it: ![Image](https://github.com/user-attachments/assets/939854d4-8026-49cf-a7d4-d0068263f752) Its seems like very hard to find bug i literally spend days to find what happens to my secrets and why it turn to "****". Only works with case sensitive secrets, so if you try to set LOKI_USER as "LOKI" and do not change password and leave it as "supersecretlokipassword" - nothing happens to it. Version of gitea what i running (but also bug reproduces in older 1.23+ versions): Latest ([1.23.6]) ### Gitea Version 1.23.6 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version 2.43.0 ### Operating System Ubuntu 24.04 ### How are you running Gitea? Running as systemd service but i think its core gitea bug so you can reproduce this behavior no matter how you run gitea ### Database MySQL/MariaDB

GiteaMirror added the topic/gitea-actions issue/needs-feedback type/bug labels 2025-11-02 11:10:06 -06:00

GiteaMirror closed this issue

2025-11-02 11:10:07 -06:00

GiteaMirror commented

2025-11-02 11:10:07 -06:00

@lunny commented on GitHub (May 10, 2025):

How did you change a secret value? It looks like it hasn't been implemented until #32362 merged.

@lunny commented on GitHub (May 10, 2025): How did you change a secret value? It looks like it hasn't been implemented until #32362 merged.

GiteaMirror commented

2025-11-02 11:10:07 -06:00

@lunny commented on GitHub (May 10, 2025):

I followed the steps, but I couldn't reproduce it. Since you just delete vars and no workflow changes, the result should like this

LOKI user var: 
LOKI user secret: ***
LOKI password var: 
LOKI password secret: ***

but not

LOKI user secret: ***
LOKI password secret: ***

@lunny commented on GitHub (May 10, 2025): I followed the steps, but I couldn't reproduce it. Since you just delete vars and no workflow changes, the result should like this ``` LOKI user var: LOKI user secret: *** LOKI password var: LOKI password secret: *** ``` but not ``` LOKI user secret: *** LOKI password secret: *** ```

GiteaMirror commented

2025-11-02 11:10:08 -06:00

@Alexsandr-Random commented on GitHub (May 10, 2025):

I followed the steps, but I couldn't reproduce it. Since you just delete vars and no workflow changes, the result should like this
LOKI user var: 
LOKI user secret: ***
LOKI password var: 
LOKI password secret: ***
but not
LOKI user secret: ***
LOKI password secret: ***

Hello. Don't close the problem, I will answer in more detail in a week. Now I'm going on vacation. Please provide the full order of actions and the value of the secrets that you created.
I have given a fairly detailed order of actions and the meaning of the secrets in the description.

@Alexsandr-Random commented on GitHub (May 10, 2025): > I followed the steps, but I couldn't reproduce it. Since you just delete vars and no workflow changes, the result should like this > > ``` > LOKI user var: > LOKI user secret: *** > LOKI password var: > LOKI password secret: *** > ``` > > but not > > ``` > LOKI user secret: *** > LOKI password secret: *** > ``` Hello. Don't close the problem, I will answer in more detail in a week. Now I'm going on vacation. Please provide the full order of actions and the value of the secrets that you created. I have given a fairly detailed order of actions and the meaning of the secrets in the description.

GiteaMirror commented

2025-11-02 11:10:08 -06:00

@GiteaBot commented on GitHub (Jun 9, 2025):

We close issues that need feedback from the author if there were no new comments for a month. 🍵

@GiteaBot commented on GitHub (Jun 9, 2025): We close issues that need feedback from the author if there were no new comments for a month. :tea:

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14334