Git & GitHub
/Advanced
Secrets & Environment Variables
Definition
Encrypted environment variables that you create in an organization, repository, or repository environment. They are used to safely pass passwords, tokens, and SSH keys to GitHub Actions.
Explain Like I'm New
If your automated robot needs to deploy your website to AWS, it needs your AWS password. If you hardcode the password into the `deploy.yml` file, the whole internet will see it. Instead, you save the password secretly in the GitHub UI, and the robot dynamically injects it into the script at runtime.
Real World Example
Storing `DATABASE_URL` or `NPM_TOKEN` securely so your CI pipeline can authenticate with third-party services.
Common Use Cases
- •Security
- •Authentication in automated pipelines
Terminal Output
bash / terminal
# .github/workflows/deploy.yml
jobs:
deploy-to-aws:
runs-on: ubuntu-latest
steps:
- name: Deploy Script
run: ./deploy.sh
# Injecting the secrets into the environment safely!
env:
AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}
AWS_SECRET_KEY: ${{ secrets.AWS_SECRET_KEY }}
Interview Questions
basic
- Can you view a secret's value in the GitHub UI after you save it?
intermediate
- If a script prints a secret using `console.log(process.env.SECRET)`, what shows up in the Action logs?