Secrets and Environment Variables

Secrets and Environment Variables

Workflow configuration comes from plain environment variables, configuration variables, inputs, and encrypted secrets. Secret masking reduces accidental log disclosure, but it does not make an untrusted workflow safe. Anyone able to modify executable workflow code may be able to exfiltrate available credentials.

Core ideas

• Repository, organization, and environment secrets differ in scope and policy.
• Environments can require reviewers, restrict deployment branches, and delay access to environment secrets.
• GITHUB_TOKEN is short-lived; its permissions should be declared explicitly.
• OpenID Connect (OIDC) lets a cloud provider issue temporary credentials based on repository and workflow claims.

How it works

Keep non-sensitive configuration in vars or env, and sensitive values in an appropriate secret store. Reference secrets only in the step that needs them, prevent shell tracing, and rotate credentials after suspected exposure. Prefer short-lived OIDC credentials to long-lived cloud keys.

Configuration example

permissions:
  contents: read
  id-token: write

env:
  REGION: ap-south-1

jobs:
  deploy:
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Configure cloud identity
        uses: example/cloud-login@8f2d4c1
        with:
          role: ${{ vars.DEPLOY_ROLE }}
      - name: Deploy
        run: ./deploy.sh "$REGION"

Read the example from top to bottom: the trigger creates a run, the job requests a runner, and each step receives only the context configured for it. Adapt names, versions, permissions, and commands to the repository rather than copying production credentials or policies blindly.

Production guidance

• Never echo secrets, write them into artifacts, or expose them to pull requests from untrusted forks.
• Use environment approvals for production and scope credentials to one workload and environment.
• Remember that structured or transformed secrets may not be masked automatically.

The chapter quiz follows this lesson and checks both the vocabulary and the operational decisions behind the configuration.