GitHub Actions Secrets
Tags: github, devops
Published: 2023-01-24 13:10:00

[GitHub Actions](https://docs.github.com/actions) is a tool that can be used to automate processes that relate to code stored within a [repository](https://docs.github.com/get-started/quickstart/create-a-repo).  You can use it to automate your Continuous Integration/Continuous Deployment (CI/CD) processes. 

When carrying out this kind of automation you need to be able to store sensitive data somewhere.  [GitHub Actions Secrets](https://docs.github.com/actions/security-guides/encrypted-secrets) can be used to store that sensitive data. 

GitHub allows you to store secrets at 3 different levels:
* Repository
* Environment
* Organization

In this article, we will look at those three levels, and how to call secrets in an example GitHub Actions workflow. 

### Repository secrets
Repository secrets are tied to the repository they are created within.  You can store 100 secrets per repository. 

**<span style="text-decoration:underline;">Add a repository secret</span>**

Open your project’s repository and click on Settings in the top menu

![GitHub repository settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8e8n9wxsb1cu19rl8cfp.png)
Click Secrets in the menu on the left hand side. 
Then select Actions. 

![GitHub menu](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bo43lu2stzvgujvejoqz.png)
Click on New Repository Secret. 

![Create new GitHub secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gdivoz7rgbq5dm0qvlwx.png)
Complete the following fields:
    * Name, give the secret a suitable name, don’t use any space or special characters.   Underscores are usable. 
    * Value, enter the secrets. 

Click on Add Secret. 

![GitHub add a new secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/spd98zmz7hv8c3m2z68f.png)

_You are able to update this secret whenever you need to change it._ 

### Environment secrets
Within GitHub you can specify different environments in which to target for your deployments, such as production, staging, or development.  

If you have a public or an enterprise licence you can set environment-specific secrets that will only work for that environment. 

There is a limit of secrets per environment, 100. 

**<span style="text-decoration:underline;">Add an environment secret when creating a new environment</span>**

Open your project’s repository and click on Settings in the top menu

![GitHub repository settings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hbcbfqguuft34uygko7p.png)

Click Environments in the left hand side menu. 

![GitHub menu](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/42or4xk5qts171m6yrg8.png)

Click on New environment. 

![GitHub create new environment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4h840ftilk503knasxht.png)

Enter a name for your environment and click Configure environment. 

Configure the environment’s protection rules and deployment branches as you require them and then click on Add Secret. 

![Add new environment secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/acgkk7rj8ae06sje2oyy.png)

Complete the following fields:
    * Name, give the secret a suitable name, don’t use any space or special characters.   Underscores are usable. 
    * Value, enter the secrets. 

Click on Add Secret. 

![Add new GitHub environment secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vp6uvk1z4mdscjtc0912.png)

If you wish to change the secret or add others for that environment in the future you can do so through Settings > Secrets > Actions. 

###  Organization secrets
An organization within GitHub is a shared account for businesses or [open-source](https://www.techielass.com/what-is-open-source/) projects to collaborate across many projects.

In 2020 GitHub announced organization secrets.  A way of sharing secrets across repositories. 

There are access policies available which allow you to control which repositories have access to an organization secret. 

**<span style="text-decoration:underline;">Add an organization secret</span>**

Open your organization’s page in GitHub and click Settings in the top menu.

Click Secrets in the left menu.

Click on Actions. 

![GitHub organisation menu](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ohn8i7qm4qagk4ktk0l.png)

Now select New organization secret. 

![Create GitHub organisation secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/18aq4f131mcepymwvc84.png)

Complete the following fields:
    * Name, give the secret a suitable name, don’t use any space or special characters.   Underscores are usable. 
    * Value, enter the secrets. 
    * Repository access, select the relevant policy or repositories you wish to be able to see this secret. 

![Add GitHub organisation secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9xfr5ndi7vtbye3r85m2.png)


###  Using secrets in GitHub Actions workflows
Within GitHub Actions workflows [contexts](https://docs.github.com/en/actions/learn-github-actions/contexts) are how GitHub pulls information from various sources.  We can use the secrets context to call your secret data in workflows. 

As an example, if you are trying to interact with Azure during a workflow. Perhaps you are [deploying an Azure Bicep template](https://www.techielass.com/deploy-azure-bicep-using-github-actions/).  You need to provide GitHub with credentials to your Azure environment. 

You might add a step such as: 
```
- name: Azure Login
     uses: Azure/login@v1.4.3
     with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
```

Here we are using the GitHub Actions action [“Azure Login”](https://github.com/marketplace/actions/azure-login).  Our Azure credentials are stored within a repository secret and we are calling them into the workflow without exposing the information to the public.  

If you’d like to learn more about GitHub Actions please do check out [my other blog posts](https://www.techielass.com/tag/github-actions/).