GitHub Actions leaks secrets due to cached Miri output

The recent identification of a vulnerability in GitHub Actions related to Miri's caching behavior reveals that environment variables, including sensitive secrets, can persist in cached outputs. This issue arises when the Miri tool is invoked during continuous integration, where it retains environment variables in the target directory that are subsequently cached.

The implications of this vulnerability are critical, as it allows anyone with access to pull requests to potentially extract sensitive information from the shared cache. This is particularly concerning given that GitHub Actions enables caching between CI runs, which can inadvertently expose secrets if proper precautions are not taken.

To mitigate this risk, the Rust Security Response Team recommends several immediate actions. Developers should disable caching for jobs running cargo miri, scope secrets to specific steps that do not invoke Miri, or temporarily disable Miri entirely until a patch is available. It is also essential to clear any existing caches that might contain leaked secrets.

The forthcoming patch aims to restrict Miri's caching behavior to only preserve necessary CARGO_* environment variables and is expected to address the issue promptly. However, developers should remain vigilant and ensure that their CI environments do not expose secrets, as many tools may not handle sensitive information securely.

Lastly, this incident underscores the importance of careful management of environment variables in CI workflows. Developers are encouraged to review their configurations and implement best practices to prevent sensitive information from being unintentionally included in caches, as this can lead to security vulnerabilities.