Environment Secrets

~12 min · environments, secrets, deploy

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Secrets scoped to a deploy target

An environment in GitHub Actions is a named deploy target (staging, production, preview). Each environment can have its own secrets, variables, protection rules, and deployment URL.

The classic shape:

staging environment with STAGING_DB_URL, STAGING_API_KEY.
production environment with PROD_DB_URL, PROD_API_KEY, plus required reviewers.
Same workflow file, two jobs — each scoped to one environment.

Why environments matter

Blast radius — a workflow run that targets staging literally cannot read production secrets. The walls are real.
Approvals — environments support 'required reviewers' (manual approval) and 'wait timer' (cooling period). The deploy job pauses until satisfied.
Branch policies — restrict an environment to specific branches (main only for prod).
Visibility — the Deployments tab shows which commit is currently in each environment, with link to the run.

Code

Two-environment deploy with scoped secrets·yaml

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - uses: actions/checkout@v4
      - env:
          DB_URL: ${{ secrets.DB_URL }}        # staging value
          API_KEY: ${{ secrets.API_KEY }}      # staging value
        run: ./deploy.sh

  deploy-prod:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production               # required reviewers configured here
      url: https://www.example.com
    steps:
      - uses: actions/checkout@v4
      - env:
          DB_URL: ${{ secrets.DB_URL }}        # production value
          API_KEY: ${{ secrets.API_KEY }}      # production value
        run: ./deploy.sh

External links

GitHub — About environments

Exercise

Create a staging and a production environment in a sandbox repo. Add a single secret API_KEY with different values in each. Write two deploy jobs, one per environment. Confirm echo of the redacted value shows different lengths.