DevOps Bootcamp · Lesson

Environment Variables and Secrets

Learn to manage sensitive information and environment-specific configurations securely within GitHub Actions.

Environment Variables and Secrets is a free DevOps Bootcamp lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Env Vars & Secrets: The Basics

Welcome to Lesson 3! In CI/CD, you often need to configure your pipelines with dynamic values or sensitive information.

This is where environment variables and secrets become indispensable. They allow your workflows to adapt to different scenarios and handle sensitive data securely.

Why Use Them in CI/CD?

Imagine deploying to different environments (development, staging, production) or connecting to external services with API keys.

Flexibility: Environment variables let you change behavior without modifying the workflow file.
Security: Secrets protect sensitive data like passwords and API tokens from being exposed.
Reusability: Define configurations once and use them across multiple jobs or steps.

Environment Variables in Actions

An environment variable is a dynamic-named value that can affect the way running processes will behave. In GitHub Actions, they're key to making your workflows configurable.

You can define your own environment variables or use the many built-in ones provided by GitHub Actions.

Built-in GitHub Actions Env Vars

GitHub Actions provides many useful, pre-defined environment variables automatically. These give you context about the repository, workflow run, and more.

For example, GITHUB_SHA is the commit hash, and GITHUB_REF is the branch or tag name that triggered the workflow.

You access them using the github context object in expressions or directly as shell variables if mapped to env.

name: Print Context Variables
on: [push]
jobs:
  display_info:
    runs-on: ubuntu-latest
    steps:
      - name: Show commit SHA
        run: echo "Commit SHA: ${{ github.sha }}"
      - name: Show branch/tag ref
        run: echo "Ref: ${{ github.ref }}"

Custom Env Vars: Workflow Scope

You can define your own environment variables at the workflow or job level. Variables defined at the workflow level are available to all jobs and steps within that workflow.

Use the env keyword at the top level of your workflow file to set them.

name: Workflow-level Env Var
on: [push]
env:
  GREETING_MESSAGE: "Hello from Workflow!"
jobs:
  my_job:
    runs-on: ubuntu-latest
    steps:
      - name: Access workflow variable
        run: echo "${{ env.GREETING_MESSAGE }}" # Access via env context
      - name: Access workflow variable (shell)
        env:
          MY_VAR_IN_SHELL: ${{ env.GREETING_MESSAGE }}
        run: echo "$MY_VAR_IN_SHELL" # Access as shell variable

Custom Env Vars: Job & Step Scope

For more specific needs, define environment variables at the job or step level. A variable defined for a job is available to all its steps, and a step-level variable is only available to that single step.

This allows for granular control over your configuration.

name: Job & Step-level Env Vars
on: [push]
jobs:
  my_job:
    runs-on: ubuntu-latest
    env:
      JOB_VAR: "Value for this job"
    steps:
      - name: Access Job-level variable
        run: echo "Job Var: ${{ env.JOB_VAR }}"
      - name: Step-specific variable
        env:
          STEP_VAR: "Value for this step"
        run: echo "Step Var: ${{ env.STEP_VAR }}"
      - name: Try to access step var in another step
        run: echo "Trying to access: ${{ env.STEP_VAR }}" || true # Will be empty

Introducing GitHub Secrets

Environment variables are great for non-sensitive data, but what about confidential information like API keys, database passwords, or private tokens?

This is where GitHub Secrets come in. They allow you to store sensitive information securely and access it in your workflows without exposing it in your repository's code or logs.

Encrypted: Stored securely by GitHub.
Redacted: Automatically hidden from workflow logs.
Controlled Access: Only available to specific workflows.

Creating GitHub Secrets

Secrets are created and managed through your repository or organization settings on GitHub, not directly in your workflow files.

Go to your repository's Settings.
Navigate to Secrets and variables > Actions.
Click New repository secret (or organization secret for broader scope).
Provide a Name (e.g., MY_API_KEY) and paste the Value.

Once saved, you cannot view a secret's value again, only update or delete it.

Using Secrets in Workflows

To use a secret, you reference it using the secrets context object in your workflow, similar to how you use env for environment variables.

GitHub automatically redacts secrets from logs, replacing their values with *** to prevent accidental exposure.

name: Use a Secret Demo
on: [push]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Display a secret (redacted)
        run: echo "My secret key is: ${{ secrets.MY_API_KEY }}"
        # GitHub Actions automatically redacts the value in logs.
      - name: Pass secret to an environment variable
        env:
          API_KEY_ENV: ${{ secrets.MY_API_KEY }}
        run: echo "API Key in env: $API_KEY_ENV"

Secret Security Best Practices

Managing secrets securely is paramount for your CI/CD pipeline's integrity. Always follow these guidelines:

Least Privilege: Grant access to secrets only where absolutely necessary.
Never Hardcode: Don't embed secrets directly in your workflow files or any repository code.
Avoid Logging: While GitHub redacts, avoid custom echo commands that might accidentally reveal parts of secrets.
Rotate Regularly: Change your secrets periodically to minimize the risk of compromise.
Environment-Specific: Use different secrets for development, staging, and production environments.

Quick Check: Env Vars vs. Secrets

Which statement accurately describes a key difference or feature of GitHub Actions environment variables and secrets?

Recap: Secure Configurations

Fantastic! You've successfully explored how to manage configurations in your GitHub Actions workflows.

Environment variables help you inject non-sensitive, dynamic data into your workflow runs, adaptable at workflow, job, or step levels.
Secrets are crucial for securely handling sensitive information like API keys, ensuring they remain encrypted and out of your public code.
Always adhere to security best practices when working with secrets to protect your deployments from vulnerabilities.

Mastering these concepts ensures your CI/CD pipelines are both flexible and secure!

Frequently asked questions

Is the “Environment Variables and Secrets” lesson free?

Yes — the full text of “Environment Variables and Secrets” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Environment Variables and Secrets”?

Learn to manage sensitive information and environment-specific configurations securely within GitHub Actions. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Environment Variables and Secrets” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Introduction to Continuous Deployment
Deploying to a Staging Environment
Environment Variables and Secrets
Deploying to Production with Approval Gates

← Back to DevOps Bootcamp