DOS5930

Codespaces Secret - Should have a name

DOS5930

GitHub repository Severitymedium builtIn

Description

Every Codespaces secret should carry a non-empty name. The codespace devcontainer references the secret via the environment variable substitution mechanism, so an unnamed secret cannot be consumed and only clutters the secrets list.

Learn More

Recommendation

1. Go to Repository or Organization Settings -> Secrets and variables -> Codespaces. 
2. Delete or rename any secret with an empty name.

Policy Rule

{
  "target": "GHCodespacesSecret",
  "if": {
    "allOf": [
      {
        "resource": "GHCodespacesSecret",
        "property": "Name",
        "operator": "notEquals",
        "value": ""
      }
    ]
  },
  "then": {
    "effect": "Audit"
  }
}
« DOS5925 DOS5935 »
Rule Details
  • Rule ID: DOS5930
  • Code: GH_Repository_Codespaces_Secret_Should_Have_Name
  • Platform: GitHub
  • Category: repository
  • Severity: Severitymedium
  • Type: builtIn
Related Rules

Copyright © DevOps Shield. All Rights Reserved. Privacy Policy | Cookie Policy | Terms and Conditions | v1.0.2