Repository Secrets

~11 min · secrets, repo, scope

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Where most secrets start

A repository secret is a key/value pair stored encrypted at rest in your repo's settings, available to workflows running in that repo. They're the default place to put a credential when you need one.

Set them via:

Repo Settings → Secrets and variables → Actions → New repository secret.
Or via CLI: gh secret set NAME --body "value".
Or via API for automation.

Properties

Encrypted at rest (libsodium sealed box).
Visible to workflows triggered by people with write access. Crucially, they are not available to workflows triggered by PRs from forks (pull_request from outside contributors).
Names are uppercase by convention. Limited charset: alphanumeric + underscore. No starting with digit. No starting with GITHUB_ (reserved).
Up to 64 KB per secret.
Up to 100 secrets per repo, 1000 per org (different limits at the environment level).

Code

Setting and using a repo secret·bash

# Set via gh CLI
gh secret set OPENAI_API_KEY --body "$OPENAI_API_KEY"

# Or pipe from a file (no shell history exposure)
gh secret set DEPLOY_KEY < ~/.ssh/deploy_key

# List secret names (values are never returned)
gh secret list

# Delete
gh secret delete OLD_TOKEN

Using a secret in a workflow·yaml

      - name: Call OpenAI
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: python scripts/llm_eval.py

External links

Exercise

Add a single repo secret to a project of yours via gh secret set. Reference it in a workflow step's env:. Confirm in the run logs that the value is redacted (shows as ***) — never visible in plaintext.

Progress

Progress is local-only — sign in to sync across devices.

← 🛡️ Building & Testing PipelinesQuiz · 5 questions Next →Using Secrets Safely

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.