Rust BlogManish Goregaokar3 min readintermediate
GitHub Actions leaking secrets when Miri output is cached
Summary
Miri writes all environment variables to the target/ directory, and when that directory is cached in GitHub Actions, secrets can be exposed to PRs. A short‑term patch now limits Miri to only preserve CARGO_* vars (excluding tokens) and OUT_DIR; until the fix lands, disable target caching or scope secrets away from Miri steps and clear existing caches.
- Miri stores every env var in target/, which can be persisted by GitHub Actions cache and leaked to PRs.
- The patch restricts Miri to only keep CARGO_* (except token vars) and OUT_DIR, preventing secret capture.
- Mitigate by disabling target/ caching, scoping secrets to non‑Miri steps, or temporarily disabling Miri.
- After fixing, clear the cache and rotate any potentially leaked secrets.
Rust project maintainers using GitHub Actions need to know this issue to avoid unintentionally leaking secrets through cached build artifacts.
6/10
