secrets
- Git course
- Advanced
- Lesson 43/56
- 4 min
Learn secret variable management with secrets.
Secure credential management with GitHub Secrets
Database passwords, server keys, or API tokens must never be written in plain text in repository files. GitHub Secrets stores these sensitive values encrypted in repository settings. Workflow steps safely access these variables via the ${{ secrets.SECRET_NAME }} syntax.
- name: Authenticate
run: ./deploy.sh
env:
API_KEY: ${{ secrets.PROD_API_KEY }}GitHub automatically masks secret values in log outputs.
Environment variables (env) and GITHUB_TOKEN
Secrets are typically passed to steps as environment variables using the env: block. Additionally, GitHub automatically provisions a secrets.GITHUB_TOKEN on every workflow run to interact with the repository. This token can create releases or publish packages.
- name: Publish release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh release create v1.0.0This lets you perform authenticated operations without manually creating external tokens.
Practice Bind secret variable to step
Add an env: block to the step and define the TOKEN: ${{ secrets.API_TOKEN }} environment variable.
Starter code
cat << 'EOF' > .github/workflows/ci.yml
steps:
- name: Servise baglan
# ortam degiskeni tanimini buraya ekle
run: echo "Baglanti basarili"
EOF
cat .github/workflows/ci.ymlSample solution
cat << 'EOF' > .github/workflows/ci.yml
steps:
- name: Servise baglan
env:
TOKEN: ${{ secrets.API_TOKEN }}
run: echo "Baglanti basarili"
EOF
cat .github/workflows/ci.ymlExpected output
steps:
- name: Servise baglan
env:
TOKEN: ${{ secrets.API_TOKEN }}
run: echo "Baglanti basarili"
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 How do you reference a defined secret in a GitHub Actions workflow?
- ${{ env.LOCAL_SECRET }}
- ${{ github.PASSWORD }}
- ${{ config.SECRET_NAME }}
- ${{ secrets.SECRET_NAME }} Correct answer
Explanation: The secrets context (${{ secrets.SECRET_NAME }}) is used to access secret variables.
2 Access secret variable
env:
KEY: ${{ ____.DEPLOY_TOKEN }} env:
KEY: ${{ secrets.DEPLOY_TOKEN }}Explanation: The ${{ secrets.<NAME> }} syntax retrieves the value of the encrypted secret stored in the repo.
3 Security concepts
| Term | Meaning |
|---|---|
secrets.<AD> |
Accesses encrypted repo variable |
GITHUB_TOKEN |
Built-in auto provisioned token |
Log maskeleme |
Masks secret values in console logs |
env: |
Binds value to environment variable |