Consider removing AWS_ACCESS_KEY_ID from mirror workflow

[udondan]

In the file /master/.github/workflows/mirror.yml#L25 you expose your AWS_ACCESS_KEY_ID.

Apart from the fact that this might be a security concern, this is causing problems on user end when scanning with security tools. For example the popular vulnerability scanner Trivy is raising a critical error.

Would be great if you could move the value to a github secret, just like the AWS_SECRET_ACCESS_KEY.

[mislav]

Thanks for raising this issue. I won't, however, move this to a secret just because a vulnerability tool considers this a critical error:

• The key is already in git. Moving it to a "secret" does not obfuscate it in any way since it doesn't remove it from git history;
• Knowing someone's access key ID can cause no damage, and is in fact no vulnerability in it of itself.

You could try configuring your scanner so it doesn't consider this a critical error.

[mislav]

Update: the AWS access key is now gone from version control