CKV_GIT_4: "Ensure GitHub Actions secrets are encrypted" error for data source referenced plaintext_value

[wenqiglantz]

Describe the issue
This issue is an expansion of #2374. I am running into the following error (see screenshot) in my github actions workflow:

Here is the relevant code snippet:

data "aws_ecr_repository" "ecr_repo" {
  name = var.ecr_repository_name
}

resource "github_actions_environment_secret" "ecr_repository_name" {
  repository      = "example"
  environment     = "dev"
  secret_name     = "ECR_REPOSITORY_NAME"
  plaintext_value = data.aws_ecr_repository.ecr_repo.name
}

My question is the value for "plaintext_value" is not a hard coded value, but a data source reference, can this scenario be excluded from your check for "plaintext_value"?

Version (please complete the following information):

• Checkov Version: master, as I am using your github action "bridgecrewio/checkov-action@master"

[gruebel]

hey @wenqiglantz thanks for reaching out. I tested it with the latest version and the check doesn't fail for me with the configuration you posted.