also the secrets will be published as double base 64 encoded, so it will just look like a string of random chars at the end of the changed-files action in the log.