Pipeline Leak

Dig a deleted secret out of git history and spot a CI workflow that hands repository secrets to strangers.

Scenario

A developer at Larkspur Logistics noticed a live API key in an old code review and deleted it straight away. The team thinks the problem is solved. The security team is not so sure, and has also been asked to review the repository's new GitHub Actions workflows before the project goes public.

You have a full copy of the repository as a git bundle. Find out exactly what leaked, where, when and by whom, and which workflow would expose secrets to anyone who opens a pull request.