Organization Secrets

~9 min · org, secrets, scope

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Share once, use across many repos

If your org runs 30 repos that all need to deploy to AWS, copy-pasting the AWS keys into 30 sets of repo secrets is a maintenance and rotation nightmare. Organization secrets exist for exactly this case.

Set at: Org Settings → Secrets and variables → Actions → New organization secret. Then choose visibility:

All repositories — every repo in the org sees it.
Private repositories — only private/internal repos.
Selected repositories — explicitly listed.

Resolution order

If both org and repo define a secret with the same name, the repo value wins. Useful for overriding org-level defaults in a single repo.

When to use which

Org secret — credentials shared by many repos: cloud provider keys, registry tokens, common API keys.
Repo secret — credentials specific to one project, or override of an org-level value.
Environment secret — credentials tied to a deploy target (covered next lesson).

Code

Set an org secret with selected repos·bash

# Set an org secret limited to specific repos
gh secret set AWS_ACCESS_KEY_ID \
  --org my-org \
  --visibility selected \
  --repos my-org/api,my-org/web,my-org/jobs \
  --body "$AWS_KEY"

# In any of those repos' workflows:
#    env:
#      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}

External links

GitHub — About organization secrets

Exercise

If you have an org with multiple repos sharing a secret, migrate it to an org secret with 'Selected repositories' visibility. Update the repos to remove the duplicate repo secret. Verify CI still passes.