A deploy token in the CI workflow file
The deploy workflow now reads its token from repository secrets, but an earlier version had it inline. Follow the history of one file to find when it was added and by whom.
Briefing
status-site is a public repository that deploys a status page. Someone noticed that the deploy workflow used to contain the hosting token in plain text before it was moved to repository secrets.
git log -p -- <path> shows every change to one file, oldest change last. A secret that was removed in a later commit is still in the earlier ones.
dev-laptop · Secrets in Git
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.