Managing Secrets in GitHub Actions

GitHub Actions secrets store encrypted values that are injected as environment variables into workflow steps. The most important rules are that secrets are not available to fork PRs by default, and they must never be printed or logged.

Secret storage and access

• Repository secrets are defined in Settings → Secrets and Variables → Actions; ${{ secrets.DOCKER_PASSWORD }} references them in workflow YAML — GitHub masks the value in logs, but masking is pattern-based and fails for base64-encoded or URL-encoded versions of the secret
• Organization secrets can be shared across multiple repositories in the organization — a NEXUS_PASSWORD used by 30 microservice repos is defined once at the org level rather than replicated in every repo
• Environment secrets are scoped to a specific deployment environment (staging, production) and can require a reviewer approval before the environment's secrets are exposed — a production deployment that requires manual approval before the PROD_KUBECONFIG secret is available prevents accidental deployments

Fork PR security

• Pull requests from forks cannot access repository secrets — this prevents a malicious PR from exfiltrating credentials by adding a run: echo ${{ secrets.DOCKER_PASSWORD }} step
• Use the pull_request_target trigger (instead of pull_request) with explicit read permissions to run CI on fork PRs without secret access — or use CodeQL's pattern of building untrusted code in a separate job with no secrets before a second job runs with secrets

Secret injection patterns

• Never put secrets in env: at the workflow level when only one step needs them — inject at the step level with env: DOCKER_PASS: ${{ secrets.DOCKER_PASSWORD }} to limit the variable's availability to that step's subprocess
• For AWS authentication, use OIDC (id-token: write permission) with aws-actions/configure-aws-credentials@v4 to assume an IAM role directly from GitHub Actions — no long-lived AWS_ACCESS_KEY_ID stored as a secret; the role is assumed using a JWT token signed by GitHub's OIDC provider