0Pricing
DevOps Bootcamp · Lesson

Secrets and Environment Variables in Actions

Learn how to securely store and use secrets and environment variables in GitHub Actions workflows.

Secrets and Environment Variables in Actions is a free DevOps Bootcamp lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Secrets Matter

Workflows often need API keys, tokens, or passwords. Hardcoding them in YAML would expose them in your repo. Secrets keep them safe and encrypted.

Where Secrets Live

You add secrets in the repository under Settings > Secrets and variables > Actions. They are encrypted and never shown again after saving.

Using a Secret

Reference a secret with the secrets context inside a workflow step.

steps:
  - name: Deploy
    run: ./deploy.sh
    env:
      API_KEY: ${{ secrets.API_KEY }}

Secrets Are Masked

GitHub automatically masks secret values in logs, replacing them with *** so they never leak in build output.

The Built-in GITHUB_TOKEN

Every workflow gets an automatic GITHUB_TOKEN secret for authenticating to the repo, without you creating one.

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Plain Environment Variables

Non-secret config can be set as plain variables at the workflow, job, or step level with the env key.

env:
  NODE_ENV: production

Repository Variables

Non-sensitive values reused across workflows can be stored as repository variables and read via the vars context.

env:
  REGION: ${{ vars.AWS_REGION }}

Environment-Scoped Secrets

GitHub Environments (like staging and production) can hold their own secrets and require approvals before they are used.

jobs:
  deploy:
    environment: production

Organization Secrets

Secrets shared across many repos can be defined at the organization level and scoped to selected repositories.

Secrets and Pull Requests from Forks

For security, secrets are not passed to workflows triggered by pull requests from forks. This prevents malicious PRs from stealing credentials.

Best Practices

Keep secrets minimal in scope, rotate them regularly, never echo them, and prefer the built-in token where possible.

Quick Check

Test your understanding of secrets in Actions.

Recap

You learned to handle secrets in Actions:

  • Store secrets in repo/org/environment settings
  • Reference them via ${{ secrets.NAME }}
  • Values are masked in logs
  • Fork PRs do not receive secrets for safety

Frequently asked questions

Is the “Secrets and Environment Variables in Actions” lesson free?

Yes — the full text of “Secrets and Environment Variables in Actions” is free to read here on the web, and the DevOps Bootcamp course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the DevOps Bootcamp course, upgrade to CoddyKit PRO.

What will I learn in “Secrets and Environment Variables in Actions”?

Learn how to securely store and use secrets and environment variables in GitHub Actions workflows. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start DevOps Bootcamp?

No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Secrets and Environment Variables in Actions” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this DevOps Bootcamp lesson?

Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Introduction to GitHub Actions
  2. Building CI/CD Workflows
  3. Custom Actions & Marketplace
  4. Secrets and Environment Variables in Actions
← Back to DevOps Bootcamp