--- title: "GitHub Actions Secrets and Environment Variables: Handle Config the Right Way" lang: "en" author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/post/github-actions-secrets-environment-variables-guide --- ![Blog post image for GitHub Actions Secrets and Environment Variables: Handle Config the Right Way - Stop leaking credentials in your workflows. This dev tip shows how to scope GitHub Actions secrets, swap long-lived keys for OIDC, mask sensitive output, and pass config between jobs without it ending up in your logs.](/_astro/hero.DSfz34Ly_Z2c5JGv.webp) [Home](/)›[Devtips](/devtips)›[All Categories](/devtips/categories)›[DevOps & DevSecOps](/devtips/categories/devops--devsecops) Devtips [Prev in DevOps & DevSecOpsContainer Image Vulnerability Scanning in CI/CD with Trivy](/devtips/post/container-image-vulnerability-scanning-trivy)[Next in DevOps & DevSecOpsPolicy-as-Code Governance with OPA/Rego](/devtips/post/policy-as-code-opa-rego) [DevOps & DevSecOps](/devtips/categories/devops--devsecops) # GitHub Actions Secrets and Environment Variables: Handle Config the Right Way [Mohammad Abu Mattar](/authors/mohammad-abu-mattar)Published: 08 Aug 2026Updated: 08 Aug 202604 Mins read07 Mins listen [Markdown for AI(opens in a new tab)](/post/github-actions-secrets-environment-variables-guide/index.md "Open the plain-Markdown version of this page, for pasting into an AI tool") TL;DR Stop leaking credentials in your workflows. This dev tip shows how to scope GitHub Actions secrets, swap long-lived keys for OIDC, mask sensitive output, and pass config between jobs without it ending up in your logs. Series [DevOps & CI/CD Pipelines](/series/devops--cicd-pipelines)4/4 [PreviousDocker Multi-Stage Builds: Smaller, Safer Images for Production](/devtips/post/docker-multi-stage-builds-smaller-production-images) All posts in this series (4) DevTips4 1. [Securing CI/CD with IAM Roles](/devtips/post/securing-cicd-with-iam-roles) 2. [ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) 3. [Docker Multi-Stage Builds: Smaller, Safer Images for Production](/devtips/post/docker-multi-stage-builds-smaller-production-images) 4. [GitHub Actions Secrets and Environment Variables: Handle Config the Right WayYou are here](/devtips/post/github-actions-secrets-environment-variables-guide) ### GitHub Actions Secrets and Environment Variables: Handle Config the Right Way Contents [Why secrets handling matters](#why-secrets-handling-matters)[Most CI leaks are config mistakes, not attacks](#most-ci-leaks-are-config-mistakes-not-attacks)[A workflow runs with real access](#a-workflow-runs-with-real-access)[The problem with sloppy config](#the-problem-with-sloppy-config)[What's the issue?](#whats-the-issue)[Real-world consequences](#real-world-consequences)[Scope, mask, and go short-lived](#scope-mask-and-go-short-lived)[Here's how to fix it](#heres-how-to-fix-it)[Implementing it](#implementing-it)[Tools and platforms](#tools-and-platforms)[Quick implementation steps](#quick-implementation-steps)[Mind the composite action gap](#mind-the-composite-action-gap)[Never echo to debug](#never-echo-to-debug)[Benefits of doing it right](#benefits-of-doing-it-right)[Why it helps](#why-it-helps)[Less rotation, less panic](#less-rotation-less-panic)[What's your approach?](#whats-your-approach)[Community discussion](#community-discussion)[Share your experience](#share-your-experience)[References](#references) ## [Why secrets handling matters](#why-secrets-handling-matters) ### [Most CI leaks are config mistakes, not attacks](#most-ci-leaks-are-config-mistakes-not-attacks) **Hey, want to stop leaking credentials in your pipelines?** Most secret leaks in CI are not the result of some clever attacker. They happen because a key got pasted into a plain environment variable, echoed into a log, or left sitting in repo settings for two years with no rotation. GitHub Actions gives you good tools to avoid all of that, but only if you use them on purpose. Handling config the right way is mostly about scoping secrets tightly and never letting them touch a log. ### [A workflow runs with real access](#a-workflow-runs-with-real-access) A workflow is a program that runs with production credentials. It talks to your cloud, your registry, and your deploy targets, often with credentials that can do real damage. Anyone who can open a pull request can trigger workflows, and anyone with repo access can read your logs and artifacts. That means the way you store and pass secrets is a security boundary, not a convenience setting. ## [The problem with sloppy config](#the-problem-with-sloppy-config) ### [What’s the issue?](#whats-the-issue) The usual pattern is to dump every secret into repository settings and reference them everywhere. Long-lived AWS keys, database passwords, and API tokens all live in one flat pile with no scope. Then someone echoes a variable to debug a failing step, or passes a secret to a job as a plain artifact, and now that value is sitting in the log output where it stays for as long as the run is retained. ### [Real-world consequences](#real-world-consequences) Once a secret lands in a log or an unmasked output, treat it as compromised. Logs get shared in bug reports, artifacts get downloaded, and forks can sometimes see more than you expect. Long-lived credentials make it worse because a leaked key stays valid until someone remembers to rotate it, which is usually after the incident. A single careless `echo` can mean an emergency key rotation across every service that used it. ## [Scope, mask, and go short-lived](#scope-mask-and-go-short-lived) ### [Here’s how to fix it](#heres-how-to-fix-it) Fixing this comes down to three habits. Scope secrets so each one is only visible where it is actually needed, mask any sensitive value so it never renders in a log, and replace long-lived cloud keys with OIDC so your workflow gets a short-lived token instead of a permanent credential. Do those three things and most of the ways a secret can escape are closed. ### [Implementing it](#implementing-it) Start with scope. Repository secrets are for values shared across the whole repo, while environment secrets are tied to a specific environment like `production` and can sit behind required reviewers. For cloud access, use OIDC instead of stored keys. .github/workflows/deploy.yml ``` 1jobs:2 deploy:3 runs-on: ubuntu-latest4 environment: production5 permissions:6 id-token: write # required for OIDC7 contents: read8 steps:9 - uses: aws-actions/configure-aws-credentials@v410 with:11 role-to-assume: arn:aws:iam::123456789012:role/deploy12 aws-region: us-east-1 ``` No AWS keys are stored anywhere. The workflow requests an OIDC token, AWS trusts it, and hands back short-lived credentials that expire when the job ends. If you do generate a secret at runtime, mask it right away with `echo "::add-mask::$TOKEN"` so it shows up as `***` in the log. ### [Tools and platforms](#tools-and-platforms) The core tools are built into GitHub Actions: repository secrets, environment secrets with protection rules, and the `::add-mask::` workflow command. For cloud auth, the official `aws-actions/configure-aws-credentials`, `google-github-actions/auth`, and `azure/login` actions all support OIDC. For a deeper audit, tools like `gitleaks` or `trufflehog` can scan your history for secrets that already slipped through. ## [Quick implementation steps](#quick-implementation-steps) **Quick takeaways** to lock down your config: - Use repository secrets for shared values and environment secrets for per-stage keys. - Put sensitive environments behind required reviewers for a manual gate. - Swap long-lived cloud keys for OIDC with a scoped IAM role. - Mask any runtime-generated secret with `::add-mask::` before using it. - Pass secrets between jobs through masked outputs, never plain artifacts. - Pass secrets into composite actions as explicit inputs. ### [Mind the composite action gap](#mind-the-composite-action-gap) Composite actions do not automatically inherit the secrets of the workflow that calls them. If your composite action needs a token, you have to pass it in as an input from the caller. Forgetting this leads to confusing empty values, and the fix is not to loosen anything, just to wire the secret through explicitly. ### [Never echo to debug](#never-echo-to-debug) When a step fails, the temptation is to print the variable to see what it holds. Do not do that with anything sensitive. Use `::add-mask::` first, or check the length and a hash instead of the raw value. A masked value stays masked even if you accidentally print it later in the same run. ## [Benefits of doing it right](#benefits-of-doing-it-right) ### [Why it helps](#why-it-helps) You shrink the blast radius of any single mistake. Scoped secrets mean a leaked value only affects one environment. OIDC means there is no permanent key to steal in the first place, since tokens expire in minutes. Masking means a careless log line does not turn into an incident. Each habit is small, but together they take most credential leaks off the table. ### [Less rotation, less panic](#less-rotation-less-panic) Long-lived keys are a standing liability that someone has to remember to rotate. OIDC removes that chore entirely for cloud access, because there is nothing stored to rotate. Environment protection rules add a human checkpoint before production secrets are ever used, so a bad change cannot quietly deploy itself. The result is fewer 2am rotations and a lot less guessing about who could have seen what. ## [What’s your approach?](#whats-your-approach) ### [Community discussion](#community-discussion) **What’s your take?** Secrets handling is one of those things that feels fine until the day it very much is not. If you have moved a pipeline from stored cloud keys to OIDC, how did the rollout go, and did it simplify your rotation story as much as you hoped? ### [Share your experience](#share-your-experience) If you have a favorite pattern for scoping secrets across a lot of environments, or a tool that caught a leak before it shipped, I would love to hear it. Especially how you handle secrets in reusable and composite actions without turning every caller into boilerplate. ## [References](#references) - [GitHub Actions: using secrets in a workflow](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions) - [About security hardening with OpenID Connect](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) - [Using environments for deployment](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment) - [Workflow commands: masking a value](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#masking-a-value-in-log) - [configure-aws-credentials action](https://github.com/aws-actions/configure-aws-credentials) Was this useful? ## Tags [#GitHub Actions](/devtips/tags/github-actions)[#Secrets](/devtips/tags/secrets)[#Environment Variables](/devtips/tags/environment-variables)[#OIDC](/devtips/tags/oidc)[#CI/CD](/devtips/tags/cicd)[#Security](/devtips/tags/security)[#Credentials](/devtips/tags/credentials) ## Share [Facebook](https://facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide "Share on Facebook")[Twitter](https://twitter.com/intent/tweet/?text=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide "Share on Twitter")[LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide&title=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way&summary=Stop%20leaking%20credentials%20in%20your%20workflows.%20This%20dev%20tip%20shows%20how%20to%20scope%20GitHub%20Actions%20secrets%2C%20swap%20long-lived%20keys%20for%20OIDC%2C%20mask%20sensitive%20output%2C%20and%20pass%20config%20between%20jobs%20without%20it%20ending%20up%20in%20your%20logs.&source=https://mkabumattar.com "Share on LinkedIn")[WhatsApp](https://wa.me/?text=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way%20https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide "Share on WhatsApp")[Telegram](https://t.me/share/url?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide&text=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way "Share on Telegram")[Reddit](https://www.reddit.com/submit?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide&title=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way "Share on Reddit")[Hacker News](http://news.ycombinator.com/submitlink?u=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide&t=GitHub%20Actions%20Secrets%20and%20Environment%20Variables%3A%20Handle%20Config%20the%20Right%20Way "Share on Hacker News")[Pinterest](https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fmkabumattar.com%2Fdevtips%2Fpost%2Fgithub-actions-secrets-environment-variables-guide&media=&description=Stop%20leaking%20credentials%20in%20your%20workflows.%20This%20dev%20tip%20shows%20how%20to%20scope%20GitHub%20Actions%20secrets%2C%20swap%20long-lived%20keys%20for%20OIDC%2C%20mask%20sensitive%20output%2C%20and%20pass%20config%20between%20jobs%20without%20it%20ending%20up%20in%20your%20logs. "Share on Pinterest")[Email]() ## Comments ## You might also enjoy More posts on similar topics [![Docker Multi-Stage Builds: Smaller, Safer Images for Production](/_astro/hero.CI-H9NMO_1DjM7c.webp)](/devtips/post/docker-multi-stage-builds-smaller-production-images) ## [Docker Multi-Stage Builds: Smaller, Safer Images for Production](/devtips/post/docker-multi-stage-builds-smaller-production-images) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Kubernetes & Containers](/devtips/categories/kubernetes--containers) Why multi-stage builds matter Image size is really about what is inside Hey, want to stop shipping a toolshed to production? If your Dockerfile builds and runs the app in one stage, your [#Docker](/devtips/tags/docker)[#Multi Stage Build](/devtips/tags/multi-stage-build)[#Container Image](/devtips/tags/container-image)+4 tags [read more](/devtips/post/docker-multi-stage-builds-smaller-production-images) [![ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/_astro/hero.D4Pcicvc_VlKXt.webp)](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) ## [ArgoCD GitOps: Sync Kubernetes Deployments Automatically from Git](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [Kubernetes & Containers](/devtips/categories/kubernetes--containers) Why GitOps for Kubernetes? From kubectl apply to Git as the source of truth Hey, want to stop deploying to Kubernetes by hand? If your releases still come from someone running \`kubectl ap [#ArgoCD](/devtips/tags/argocd)[#GitOps](/devtips/tags/gitops)[#Kubernetes](/devtips/tags/kubernetes)+4 tags [read more](/devtips/post/argocd-gitops-kubernetes-deployments-git-sync) [![Securing CI/CD with IAM Roles](/_astro/hero.Bl9B2DZz_ZDIuXQ.webp)](/devtips/post/securing-cicd-with-iam-roles) ## [Securing CI/CD with IAM Roles](/devtips/post/securing-cicd-with-iam-roles) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why secure your CI/CD pipeline? Why pipeline security matters Your pipeline holds credentials for every environment you deploy to, which makes it one of the most valuable targets you own. A s [#CICD Security](/devtips/tags/cicd-security)[#IAM Roles](/devtips/tags/iam-roles)[#Least Privilege](/devtips/tags/least-privilege)+4 tags [read more](/devtips/post/securing-cicd-with-iam-roles) [![Container Image Vulnerability Scanning in CI/CD with Trivy](/_astro/hero.yY1orHlw_2oq3jw.webp)](/devtips/post/container-image-vulnerability-scanning-trivy) ## [Container Image Vulnerability Scanning in CI/CD with Trivy](/devtips/post/container-image-vulnerability-scanning-trivy) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why container security matters Where the vulnerabilities hide A container image is one of the largest pieces of untrusted code you ship. Every image you build carries the base OS layer, [#Container Security](/devtips/tags/container-security)[#Vulnerability Scanning](/devtips/tags/vulnerability-scanning)[#Trivy](/devtips/tags/trivy)+4 tags [read more](/devtips/post/container-image-vulnerability-scanning-trivy) [![7 Reasons Learning the Linux Terminal is Worth It (Even for Beginners)](/_astro/hero.Ci9C_A6W_1AKnQ0.webp)](/devtips/post/7-reasons-learning-linux-terminal-worth-it-beginners) ## [7 Reasons Learning the Linux Terminal is Worth It (Even for Beginners)](/devtips/post/7-reasons-learning-linux-terminal-worth-it-beginners) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why learn the Linux terminal? Why it still matters Even with the graphical tools and AI assistants available now, the terminal is the most direct way to work with a Linux system. It's a core [#Linux](/devtips/tags/linux)[#Terminal](/devtips/tags/terminal)[#Command Line](/devtips/tags/command-line)+4 tags [read more](/devtips/post/7-reasons-learning-linux-terminal-worth-it-beginners) [![Policy-as-Code Governance with OPA/Rego](/_astro/hero.CwAJ64Mi_1WeH9p.webp)](/devtips/post/policy-as-code-opa-rego) ## [Policy-as-Code Governance with OPA/Rego](/devtips/post/policy-as-code-opa-rego) - [Mohammad Abu Mattar](/authors/mohammad-abu-mattar) - [DevOps & DevSecOps](/devtips/categories/devops--devsecops) Why policy-as-code matters The governance problem Managing infrastructure at scale gets complicated fast. As your infrastructure grows, keeping it consistent and compliant gets harder. M [#Policy as Code](/devtips/tags/policy-as-code)[#OPA/Rego](/devtips/tags/oparego)[#Compliance](/devtips/tags/compliance)+4 tags [read more](/devtips/post/policy-as-code-opa-rego) 6 related posts