Original announcement: GitHub · 2026-11-09. Read the official announcement.
Summary of the Update
On November 9, 2026, GitHub announced a public preview of an expanded secret scanning feature that includes scanning GitHub Actions workflow logs for exposed secrets. Previously, secret scanning primarily covered source code, issues, wikis, discussions, and pull requests. This new capability aims to help enterprises identify sensitive information unintentionally logged during automated workflow runs.
What Changed and When
When a GitHub Actions workflow run finishes, GitHub now scans the workflow logs for known provider secret patterns as part of secret scanning. If secrets are detected, alerts appear alongside traditional secret scanning alerts within the repository’s alert list. These alerts provide links back to the relevant workflow logs and remain accessible even if the logs themselves have been deleted. This feature entered public preview on November 9, 2026.
Who Should Care
This update primarily impacts organizations using GitHub Enterprise Cloud with either GitHub Secret Protection or GitHub Advanced Security enabled. It’s particularly relevant for enterprise owners and security teams responsible for managing confidential credentials and preventing leaks in CI/CD pipelines that utilize GitHub Actions workflows.
Enabling and Using the Feature
- Enterprise owners can enable the scanning feature through Enterprise Settings > Policies > Advanced Security.
- The setting is disabled by default and only applies to repositories already enrolled in secret scanning under eligible licenses.
- Only workflow runs completed after enabling the feature will be scanned; existing workflow logs are not retroactively scanned.
- The preview does not detect secrets masked by Actions or those found via generic, custom, or AI-detected patterns.
- During the preview, alerts generated from workflow logs do not trigger notifications, requiring manual review in the secret scanning alert list.
Next Steps for Developers and Enterprises
To leverage this new protection:
- Verify Eligibility: Confirm your organization uses GitHub Enterprise Cloud with the appropriate secret scanning licenses.
- Enable the Feature: Enterprise owners should activate Actions workflow log scanning in the enterprise settings as described above.
- Review Alerts: Regularly check the secret scanning alert list for any workflow log findings, considering these alerts may not trigger notifications yet.
- Enhance Workflows: Investigate and remediate any detected secrets in workflow logs to prevent credential exposure.
- Stay Updated: Monitor GitHub documentation and community discussions for changes once the preview ends or the feature becomes generally available.
Important Considerations
- Backfilling past workflow logs is not supported; only new workflow runs are scanned after enabling.
- Some secret types and detection methods are not included in this preview.
- The absence of notifications means teams should proactively monitor alerts to catch exposures promptly.
Summary Checklist
1. Confirm enterprise license supports secret scanning.
2. Access enterprise settings and enable secret scanning for Actions logs.
3. Understand that only new workflow runs post-enablement are scanned.
4. Regularly review the repository secret scanning alert list.
5. Respond to detected secrets by rotating and removing exposed credentials.
6. Follow GitHub announcements for feature updates beyond preview.
