GitHub Actions Secrets Tutorial: Variables, Scopes and Forks

• The secret is empty inside the job

  An expression for a secret the run does not have returns an empty string, so the step carries on with nothing. Check, in order: the job runs from a fork's pull request or from Dependabot, which get no secrets; the secret is an environment secret but the job has no environment: key; a reusable workflow was called without passing it; or the name is spelt differently.

• A condition that reads a secret

  if: secrets.DEPLOY_KEY != '' looks reasonable, but the secrets context is not available in if: keys. Set the secret as a job-level env: entry and write the step's condition as if: env.DEPLOY_KEY != '' instead, which is the pattern GitHub documents.

• A secret shows up in a log anyway

  Redaction matches what the runner knows, so a transformed copy, a value inside a JSON blob, or a token derived from a secret can print in the clear. Delete the log and rotate the secret first. Then store one value per secret, register derived values with ::add-mask::, and stop printing the value at all.

• pull_request_target builds a fork's code with your secrets

  A workflow switched to pull_request_target so that fork pull requests can reach a secret, then checks out the pull request head and runs npm install. The fork's code now runs with your token and secrets. Keep builds of fork code on pull_request, and use pull_request_target only for trusted work such as labelling.

1. 1

   Create the test repository with a README, so it has a main branch, and clone it.

   gh repo create secrets-lab --public --clone --add-readme
   cd secrets-lab

   Copy
2. 2

   Set one secret and one variable. gh secret list shows the name and when it changed, never the value; gh variable list shows the value as well.

   gh secret set DEMO_SECRET --body "practice-only"
   gh variable set DEMO_GREETING --body "hello from a variable"
   gh secret list
   gh variable list

   Copy
3. 3

   Add a workflow that reads both through a job-level env:, runs one step only when the secret arrived, and masks a value it makes itself. Commit and push.

   mkdir -p .github/workflows
   cat > .github/workflows/lab.yml <<'EOF'
   name: Secrets lab
   on: [push, pull_request]
   permissions:
     contents: read
   jobs:
     show:
       runs-on: ubuntu-latest
       env:
         DEMO_SECRET: ${{ secrets.DEMO_SECRET }}
         DEMO_GREETING: ${{ vars.DEMO_GREETING }}
       steps:
         - name: Print a variable and a secret
           run: |
             echo "Variable: $DEMO_GREETING"
             echo "Secret: $DEMO_SECRET"
         - name: Run only when the secret arrived
           if: env.DEMO_SECRET != ''
           run: echo "The secret reached this run"
         - name: Mask a value you made yourself
           run: |
             derived="lab-$RANDOM"
             echo "::add-mask::$derived"
             echo "Derived: $derived"
   EOF
   git add .github
   git commit -m "Add a secrets lab workflow"
   git push

   Copy
4. 4

   Give the run a few seconds to start, then watch it and read its log. The variable prints as typed, while the secret and the derived value show ***.

   run_id=$(gh run list --limit 1 --json databaseId --jq '.[0].databaseId')
   gh run watch "$run_id"
   gh run view "$run_id" --log | grep -E "Variable:|Secret:|Derived:|reached"

   Copy
5. 5

   In the browser, open Settings, Environments, New environment. Name it lab, tick Required reviewers, add yourself and save. Give lab its own DEMO_SECRET with a longer value, and add a job that names the environment. The run waits for your approval; approve it on the run page, and the log prints Length 20, the environment's value, not 13.

   gh secret set DEMO_SECRET --env lab --body "lab-environment-only"
   cat >> .github/workflows/lab.yml <<'EOF'
     gated:
       if: github.event_name == 'push'
       runs-on: ubuntu-latest
       environment: lab
       steps:
         - name: Which DEMO_SECRET won?
           env:
             DEMO_SECRET: ${{ secrets.DEMO_SECRET }}
           run: echo "Length ${#DEMO_SECRET}"
   EOF
   git commit -am "Add a gated job"
   git push

   Copy
6. 6

   From a second account, fork secrets-lab, edit README.md in the fork and open a pull request. If GitHub asks, approve the run: first-time contributors need approval by default. In that run, Secret: prints nothing after the colon, and the step that needs the secret is skipped.

7. 7

   Delete the test repository. Deleting needs the delete_repo scope, and --yes skips the prompt only when you name the repository as owner/name.

   cd ..
   gh auth refresh -s delete_repo
   gh repo delete YOUR-USER/secrets-lab --yes

   Copy

From: 23. Docker Healthcheck Tutorial: Health States and Restart Policies · 21. YAML Tutorial for Beginners: Maps, Lists, Quotes and Traps

1. 1.This site's VPS_SSH_HOST is not a password. Why is it a secret rather than a variable?Show the answer

   Answer:Because variables print unmasked and secrets are redacted. As a secret, the server's address shows as *** in every run log instead of being written out in full.

2. 2.How do you run a step only when a secret is set?Show the answer

   Answer:The secrets context is not available in if:. Copy the secret into a job-level env: entry and test it in the step's condition: if: env.NAME != ''.

3. 3.The deploy job lists contents: read and packages: read. What may its GITHUB_TOKEN do with issues?Show the answer

   Answer:Nothing. Once a permissions: block lists any permission, every permission it does not list is set to none, so the token can read the repository and pull packages and nothing else.

• secret scanning and preventing credential leaks on GitHub
• GitHub Actions OIDC: cloud access without long-lived secrets
• an automated secrets rotation strategy
• encrypting secrets in Git with SOPS and age