Secret Injection Diff

Bundled sample / no setup

Catch a new secret recipient

This recorded run uses the same files as secret-injection-diff demo.

Sample result

The publish step gains NPM_TOKEN

sample/.github/workflows/release.yml

      
Sample data is loaded.

      
What changed
One process crossed the boundary
The review step already had the name. The new publish step did not.

      
  1. Before
    Only “Check package” receives NPM_TOKEN.
  2. After
    “Publish package” receives the same secret name.
  3. Result
    The check returns exit code 2 until the edge is approved.