Managing GitHub Secrets and Variables

Introduction

GitHub Actions supports secrets for sensitive data and variables for non-sensitive configuration. They can be defined at the repository, organization, or environment level.

Creating Secrets

1. Navigate to Settings > Secrets and variables > Actions.
2. Under Repository secrets, click New repository secret.
3. Give the secret a name and value, then click Add secret.

Use a secret in a workflow:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "$SECRET" | some-command
        env:
          SECRET: ${{ secrets.MY_SECRET }}

Defining Variables

1. From the same settings page, select Variables.
2. Click New repository variable and provide a name and value.
3. Reference the variable with ${{ vars.MY_VAR }} inside workflows.

Best Practices

• Use environment secrets for deployments to staging or production.
• Rotate secrets regularly and remove unused values.
• Mask secrets in workflow logs using ::add-mask:: if needed.

Further Reading

• Secrets and variables in GitHub Actions