GitHub Actions Cheatsheet

Secrets and Environment

Use this GitHub Actions reference while you build software engineering projects, review code, or refresh the syntax you reach for most.

Secret Types

Type	Scope	Set in
Repository secret	One repo	Repo → Settings → Secrets and variables → Actions
Organization secret	Selected/all repos in org	Org → Settings → Secrets and variables → Actions
Environment secret	One deployment environment	Repo → Settings → Environments → `<env>` → Secrets
`GITHUB_TOKEN`	Current repo, current run	Auto-provisioned; no setup needed

Using Secrets

steps:
  - run: ./deploy.sh
    env:
      API_KEY: ${{ secrets.API_KEY }}
      DB_URL: ${{ secrets.DATABASE_URL }}

  # GITHUB_TOKEN is always available
  - run: gh pr comment --body "Done"
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Secrets are never printed in logs — they appear as ***. Never echo a secret directly; pass via environment variables.

`GITHUB_TOKEN` — Default Permissions

Permission	Default
`contents`	read (write on default branch push)
`packages`	read
`pull-requests`	read
`issues`	read
`id-token`	none
`deployments`	read
`pages`	none

Override at workflow or job level:

permissions:
  contents: write
  pull-requests: write
  issues: write

Variables (Non-Secret Configuration)

Unencrypted key-value pairs visible in logs:

# Access repo/org variables
- run: echo "APP_ENV=${{ vars.APP_ENV }}"
- run: echo "API_URL=${{ vars.API_URL }}"

Set via: Repo → Settings → Secrets and variables → Actions → Variables tab.

Scope matches secrets: repository, organization, environment.

Environment-Level Secrets

jobs:
  deploy:
    environment: production       # gates on required reviewers, rules
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}    # from the 'production' environment

OIDC — Keyless Cloud Auth

Eliminates long-lived cloud credentials. The runner gets a short-lived OIDC token that cloud providers verify.

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActions
          aws-region: us-east-1
          # No static AWS_ACCESS_KEY_ID needed

      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/...
          service_account: ci@my-project.iam.gserviceaccount.com

      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

Setting Environment Variables

# In workflow/job/step env: key
env:
  NODE_ENV: production
  API_URL: https://api.example.com

# From a step (available to later steps in the same job)
- run: echo "VERSION=$(cat VERSION)" >> $GITHUB_ENV

# From a secret
- run: npm run deploy
  env:
    TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Variable Precedence (highest → lowest)

Step env:
Job env:
Workflow env:
$GITHUB_ENV (set by prior step)
Runner environment defaults

Masking Values in Logs

- run: echo "::add-mask::$MY_SECRET"

Or in JS:

core.setSecret(value);

Any subsequent occurrence of that string in logs is replaced with ***.

Encrypted Secrets via CLI

# Set a repo secret
gh secret set MY_SECRET --body "my-value"
gh secret set MY_SECRET < secret.txt

# From environment variable
gh secret set MY_SECRET --env-file .env

# Set at org level
gh secret set MY_SECRET --org my-org --visibility all

# Set for a specific environment
gh secret set MY_SECRET --env production

# List secrets (names only, not values)
gh secret list
gh secret list --env production

# Delete a secret
gh secret delete MY_SECRET

Variables via CLI

# Set a variable
gh variable set APP_ENV --body "staging"
gh variable set APP_ENV --org my-org

# List variables
gh variable list

# Delete a variable
gh variable delete APP_ENV

Common Patterns

# NPM publish with token
- run: npm publish
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

# SSH deployment
- run: |
    eval "$(ssh-agent -s)"
    ssh-add - <<< "${{ secrets.SSH_PRIVATE_KEY }}"
    rsync -avz dist/ user@host:/var/www/

# Docker registry login
- uses: docker/login-action@v3
  with:
    username: ${{ secrets.DOCKER_USERNAME }}
    password: ${{ secrets.DOCKER_PASSWORD }}

# GitHub Packages (GHCR) — no secret needed
- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

`GITHUB_TOKEN` Scope Summary

# Minimal — read-only for most things
permissions: read-all

# Common CI pattern
permissions:
  contents: read
  checks: write          # annotate test results
  pull-requests: write   # post comments

# Release workflow
permissions:
  contents: write        # create releases, push tags
  packages: write        # push to GHCR

# Pages deploy
permissions:
  contents: read
  pages: write
  id-token: write