4. Secrets & environment variables
CI/CD Pipelines · 48 pages source format
Secrets never in code or logs. GitHub Secrets, environments, and OIDC for cloud — the safe patterns.
What you'll learn
- Repository secrets
- Environment secrets
- Masking in logs
- OIDC awareness
Add a repository secret
Settings → Secrets → Actions. Reference as ${{ secrets.API_TOKEN }} in workflow.
env:
API_TOKEN: ${{ secrets.API_TOKEN }}
run: |
curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com/healthDo this now
Add DUMMY_TOKEN secret. Echo in step with env: — confirm it masks in logs.
Never print secrets
Avoid echo $SECRET. GitHub masks known secrets — do not bypass with base64 tricks in real repos.
Do this now
Add SECRETS.md: rules for rotating and scoping secrets.
Environment-specific secrets
staging vs production secrets in GitHub Environments — different values, protection rules.
Do this now
Create staging environment with one secret. Reference environment in job.
OIDC (awareness)
GitHub OIDC lets workflows assume AWS/Azure roles without long-lived keys. Know for enterprise.
Do this now
Read GitHub OIDC doc summary. Write 2 sentences in SECRETS.md.