Secrets and permissions

Keys don't belong in YAML

Deploying needs credentials — an API token, an SSH key. Writing them in the workflow would leak them to anyone who can read the repo. secrets are stored encrypted in the repository settings and injected at run time, and GitHub masks them as * in logs.

Using secrets safely

name: Deploy
on: push
permissions:
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - name: Deploy
        run: ./scripts/deploy.sh
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
      - run: echo "Oops, printing $DEPLOY_TOKEN"
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Secrets aren't passed to workflows triggered from forks.
Prefer short-lived credentials (OIDC) over long-lived keys when your cloud supports it.
vars.NAME holds non-secret configuration.

Keys don't belong in YAML

Using secrets safely

The rest of this lesson