Variables (Non-Secret Configuration)

~8 min · variables, vars, config

Level 0Apprentice

0 XP0/101 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Not everything is a secret

An AWS region, a default model name, a feature flag URL — these are configuration, not secrets. They don't need encryption at rest. They do need to be visible in logs (for debugging) and shareable across repos.

GitHub provides variables alongside secrets. Same scoping (repo, org, environment), but:

Stored in plaintext.
Visible in logs (no redaction).
Accessed via vars.NAME instead of secrets.NAME.
Same UI: Settings → Secrets and variables → Actions → Variables tab.

What goes where

Variable (vars.X)	Secret (secrets.X)
AWS_REGION	AWS_ACCESS_KEY_ID
OPENAI_MODEL	OPENAI_API_KEY
PYTHON_VERSION	—
STAGING_HOST	STAGING_SSH_KEY

The rule of thumb: if leaking it would be fine on a public log, it's a variable. If leaking it would require rotation, it's a secret.

Code

Mix of vars and secrets·yaml

      - name: Configure AWS
        env:
          AWS_REGION: ${{ vars.AWS_REGION }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        run: aws sts get-caller-identity

External links

GitHub — Defining configuration variables

Exercise

Audit one repo's secrets. Move any non-sensitive ones (versions, regions, hostnames without auth) to variables. Update workflow references from secrets.X to vars.X.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousEnvironment Secrets Next →Environment Protection Rules

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.