prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  CKV_GIT_4 always fail with terraform_plan
  **Describe the issue**
  Once a GitHub org/repo secret is created and stored in the terraform state, the check CKV_GIT_4 will always fail when scanning terraform plans even if the value was created using an encrypted value.
  
  It seems like the check consider `"plaintext_text": ""` to be a hard-coded secret because if I remove that line from the plan or change it to `"plaintext_text": null`, the check passes.
  
  ```
        "resources": [
          {
            "address": "github_actions_organization_secret.my_github_secret",
            "mode": "managed",
            "type": "github_actions_organization_secret",
            "name": "my_github_secret",
            "provider_name": "registry.terraform.io/integrations/github",
            "schema_version": 0,
            "values": {
              "created_at": "2023-05-17 13:54:59 +0000 UTC",
              "encrypted_value": "MIr5c6eSzTJeGW/uyB0u...",
              "id": "MY_GITHUB_SECRET",
              "plaintext_value": "",
              "secret_name": "MY_GITHUB_SECRET",
              "selected_repository_ids": [],
              "updated_at": "2023-05-17 13:54:59 +0000 UTC",
              "visibility": "all"
            },
            "sensitive_values": {
              "selected_repository_ids": []
            }
          }
  ```
  
  **Examples**
  
  
  **Version (please complete the following information):**
   - Checkov Version 2.3.223
  
  **Additional context**
  Add any other context about the problem here.
  
  
  </issue>
  <code>
  [start of checkov/terraform/checks/resource/github/SecretsEncrypted.py]
  1 from typing import List, Any, Dict
  2 
  3 from checkov.common.models.enums import CheckCategories, CheckResult
  4 from checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck
  5 from checkov.common.models.consts import ANY_VALUE
  6 
  7 
  8 class SecretsEncrypted(BaseResourceNegativeValueCheck):
  9     def __init__(self) -> None:
  10         #  -from github docs "It is also advised that you do not store plaintext values in your code but rather populate
  11         #  the encrypted_value using fields from a resource, data source or variable as,
  12         #  while encrypted in state, these will be easily accessible in your code"
  13         name = "Ensure GitHub Actions secrets are encrypted"
  14         id = "CKV_GIT_4"
  15         supported_resources = (
  16             "github_actions_environment_secret",
  17             "github_actions_organization_secret",
  18             "github_actions_secret",
  19         )
  20         categories = (CheckCategories.ENCRYPTION,)
  21         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  22 
  23     def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
  24         plaintext = conf.get("plaintext_value")
  25         if plaintext and self._is_variable_dependant(plaintext[0]):
  26             return CheckResult.UNKNOWN
  27 
  28         return super().scan_resource_conf(conf)
  29 
  30     def get_inspected_key(self) -> str:
  31         return "plaintext_value"
  32 
  33     def get_forbidden_values(self) -> List[Any]:
  34         return [ANY_VALUE]
  35 
  36 
  37 check = SecretsEncrypted()
  38
  [end of checkov/terraform/checks/resource/github/SecretsEncrypted.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/checkov/terraform/checks/resource/github/SecretsEncrypted.py b/checkov/terraform/checks/resource/github/SecretsEncrypted.py
  --- a/checkov/terraform/checks/resource/github/SecretsEncrypted.py
  +++ b/checkov/terraform/checks/resource/github/SecretsEncrypted.py
  @@ -25,6 +25,10 @@
           if plaintext and self._is_variable_dependant(plaintext[0]):
               return CheckResult.UNKNOWN
   
  +        if isinstance(plaintext, list) and not plaintext[0]:
  +            # this happens mainly in TF plan files, because the value is just an empty string
  +            return CheckResult.PASSED
  +
           return super().scan_resource_conf(conf)
   
       def get_inspected_key(self) -> str:
  
verification_info: {"golden_diff": "diff --git a/checkov/terraform/checks/resource/github/SecretsEncrypted.py b/checkov/terraform/checks/resource/github/SecretsEncrypted.py\n--- a/checkov/terraform/checks/resource/github/SecretsEncrypted.py\n+++ b/checkov/terraform/checks/resource/github/SecretsEncrypted.py\n@@ -25,6 +25,10 @@\n         if plaintext and self._is_variable_dependant(plaintext[0]):\n             return CheckResult.UNKNOWN\n \n+        if isinstance(plaintext, list) and not plaintext[0]:\n+            # this happens mainly in TF plan files, because the value is just an empty string\n+            return CheckResult.PASSED\n+\n         return super().scan_resource_conf(conf)\n \n     def get_inspected_key(self) -> str:\n", "issue": "CKV_GIT_4 always fail with terraform_plan\n**Describe the issue**\r\nOnce a GitHub org/repo secret is created and stored in the terraform state, the check CKV_GIT_4 will always fail when scanning terraform plans even if the value was created using an encrypted value.\r\n\r\nIt seems like the check consider `\"plaintext_text\": \"\"` to be a hard-coded secret because if I remove that line from the plan or change it to `\"plaintext_text\": null`, the check passes.\r\n\r\n```\r\n      \"resources\": [\r\n        {\r\n          \"address\": \"github_actions_organization_secret.my_github_secret\",\r\n          \"mode\": \"managed\",\r\n          \"type\": \"github_actions_organization_secret\",\r\n          \"name\": \"my_github_secret\",\r\n          \"provider_name\": \"registry.terraform.io/integrations/github\",\r\n          \"schema_version\": 0,\r\n          \"values\": {\r\n            \"created_at\": \"2023-05-17 13:54:59 +0000 UTC\",\r\n            \"encrypted_value\": \"MIr5c6eSzTJeGW/uyB0u...\",\r\n            \"id\": \"MY_GITHUB_SECRET\",\r\n            \"plaintext_value\": \"\",\r\n            \"secret_name\": \"MY_GITHUB_SECRET\",\r\n            \"selected_repository_ids\": [],\r\n            \"updated_at\": \"2023-05-17 13:54:59 +0000 UTC\",\r\n            \"visibility\": \"all\"\r\n          },\r\n          \"sensitive_values\": {\r\n            \"selected_repository_ids\": []\r\n          }\r\n        }\r\n```\r\n\r\n**Examples**\r\n\r\n\r\n**Version (please complete the following information):**\r\n - Checkov Version 2.3.223\r\n\r\n**Additional context**\r\nAdd any other context about the problem here.\r\n\n", "before_files": [{"content": "from typing import List, Any, Dict\n\nfrom checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.terraform.checks.resource.base_resource_negative_value_check import BaseResourceNegativeValueCheck\nfrom checkov.common.models.consts import ANY_VALUE\n\n\nclass SecretsEncrypted(BaseResourceNegativeValueCheck):\n    def __init__(self) -> None:\n        #  -from github docs \"It is also advised that you do not store plaintext values in your code but rather populate\n        #  the encrypted_value using fields from a resource, data source or variable as,\n        #  while encrypted in state, these will be easily accessible in your code\"\n        name = \"Ensure GitHub Actions secrets are encrypted\"\n        id = \"CKV_GIT_4\"\n        supported_resources = (\n            \"github_actions_environment_secret\",\n            \"github_actions_organization_secret\",\n            \"github_actions_secret\",\n        )\n        categories = (CheckCategories.ENCRYPTION,)\n        super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)\n\n    def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:\n        plaintext = conf.get(\"plaintext_value\")\n        if plaintext and self._is_variable_dependant(plaintext[0]):\n            return CheckResult.UNKNOWN\n\n        return super().scan_resource_conf(conf)\n\n    def get_inspected_key(self) -> str:\n        return \"plaintext_value\"\n\n    def get_forbidden_values(self) -> List[Any]:\n        return [ANY_VALUE]\n\n\ncheck = SecretsEncrypted()\n", "path": "checkov/terraform/checks/resource/github/SecretsEncrypted.py"}]}