Secrets and Environment Variables in Actions

Workflows often need API keys, tokens, or passwords. Hardcoding them in YAML would expose them in your repo. Secrets keep them safe and encrypted.

You add secrets in the repository under Settings > Secrets and variables > Actions. They are encrypted and never shown again after saving.

Reference a secret with the secrets context inside a workflow step.

GitHub automatically masks secret values in logs, replacing them with *** so they never leak in build output.

Every workflow gets an automatic GITHUB_TOKEN secret for authenticating to the repo, without you creating one.

Non-secret config can be set as plain variables at the workflow, job, or step level with the env key.

Non-sensitive values reused across workflows can be stored as repository variables and read via the vars context.

GitHub Environments (like staging and production) can hold their own secrets and require approvals before they are used.

Secrets shared across many repos can be defined at the organization level and scoped to selected repositories.

For security, secrets are not passed to workflows triggered by pull requests from forks. This prevents malicious PRs from stealing credentials.

Keep secrets minimal in scope, rotate them regularly, never echo them, and prefer the built-in token where possible.

You learned to handle secrets in Actions:

• Store secrets in repo/org/environment settings
• Reference them via ${{ secrets.NAME }}
• Values are masked in logs
• Fork PRs do not receive secrets for safety