You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{% data reusables.actions.enterprise-github-hosted-runners %}
13
-
14
13
## About secrets
15
14
16
15
Secrets allow you to store sensitive information in your organization, repository, or repository environments. Secrets are variables that you create to use in {% data variables.product.prodname_actions %} workflows in an organization, repository, or repository environment.
17
16
18
17
{% data variables.product.prodname_actions %} can only read a secret if you explicitly include the secret in a workflow.
19
18
20
-
## Naming your secrets
21
-
22
-
>[!TIP]
23
-
> To help ensure that {% data variables.product.prodname_dotcom %} redacts your secrets in logs correctly, avoid using structured data as the values of secrets.
24
-
25
-
The following rules apply to secret names:
26
-
27
-
{% data reusables.actions.actions-secrets-and-variables-naming %}
28
-
29
-
{% data reusables.codespaces.secret-precedence %} Similarly, if an organization, repository, and environment all have a secret with the same name, the environment-level secret takes precedence.
30
-
31
-
## Using your secrets in workflows
32
-
33
-
{% data reusables.actions.secrets-redaction-warning %}
19
+
## Organization-level secrets
34
20
35
21
{% data reusables.actions.secrets-org-level-overview %}
36
22
23
+
When creating a secret for an organization, you can use a policy to limit access by repository. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories.
24
+
37
25
For environment secrets, you can enable required reviewers to control access to the secrets. A workflow job cannot access environment secrets until approval is granted by required approvers.
38
26
39
27
To make a secret available to an action, you must set the secret as an input or environment variable in your workflow file. Review the action's README file to learn about which inputs and environment variables the action expects. See [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsenv).
40
28
41
-
Organization and repository secrets are read when a workflow run is queued, and environment secrets are read when a job referencing the environment starts.
42
-
43
29
## Limiting credential permissions
44
30
45
31
When generating credentials, we recommend that you grant the minimum permissions possible. For example, instead of using personal credentials, use [deploy keys](/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys) or a service account. Consider granting read-only permissions if that's all that is needed, and limit access as much as possible.
@@ -48,6 +34,18 @@ When generating a {% data variables.product.pat_v1 %}, select the fewest scopes
48
34
49
35
Instead of using a {% data variables.product.pat_generic %}, consider using a {% data variables.product.prodname_github_app %}, which uses fine-grained permissions and short lived tokens, similar to a {% data variables.product.pat_v2 %}. Unlike a {% data variables.product.pat_generic %}, a {% data variables.product.prodname_github_app %} is not tied to a user, so the workflow will continue to work even if the user who installed the app leaves your organization. For more information, see [AUTOTITLE](/apps/creating-github-apps/guides/making-authenticated-api-requests-with-a-github-app-in-a-github-actions-workflow).
50
36
37
+
## Automatically redacted secrets
38
+
39
+
{% data variables.product.prodname_actions %} automatically redacts the contents of all {% data variables.product.prodname_dotcom %} secrets that are printed to workflow logs.
40
+
41
+
{% data variables.product.prodname_actions %} also redacts information that is recognized as sensitive, but is not stored as a secret. For a list of automatically redacted secrets, see [AUTOTITLE](/actions/reference/secrets-reference#automatically-redacted-secrets).
42
+
43
+
> [!NOTE] If you would like other types of sensitive information to be automatically redacted, please reach out to us in our [community discussions](https://github.com/orgs/community/discussions?discussions_q=is%3Aopen+label%3AActions).
44
+
45
+
As a habit of best practice, you should mask all sensitive information that is not a {% data variables.product.prodname_dotcom %} secret by using `::add-mask::VALUE`. This causes the value to be treated as a secret and redacted from logs. For more information about masking data, see [AUTOTITLE](/actions/using-workflows/workflow-commands-for-github-actions#masking-a-value-in-a-log).
46
+
47
+
Redacting of secrets is performed by your workflow runners. This means a secret will only be redacted if it was used within a job and is accessible by the runner. If an unredacted secret is sent to a workflow run log, you should delete the log and rotate the secret. For information on deleting logs, see [AUTOTITLE](/actions/monitoring-and-troubleshooting-workflows/using-workflow-run-logs#deleting-logs).
Copy file name to clipboardExpand all lines: content/actions/concepts/workflows-and-actions/variables.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ You can set your own custom variables or use the default environment variables t
20
20
You can set a custom variable in two ways.
21
21
22
22
* To define an environment variable for use in a single workflow, you can use the `env` key in the workflow file. For more information, see [Defining environment variables for a single workflow](/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#defining-environment-variables-for-a-single-workflow).
23
-
* To define a configuration variable across multiple workflows, you can define it at the organization, repository, or environment level. For more information, see [Defining configuration variables for multiple workflows](/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#defining-configuration-variables-for-multiple-workflows).
23
+
* To define a configuration variable across multiple workflows, you can define it at the organization, repository, or environment level. When creating a variable in an organization, you can use a policy to limit access by repository. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories. For more information, see [Defining configuration variables for multiple workflows](/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#defining-configuration-variables-for-multiple-workflows).
24
24
25
25
> [!WARNING]
26
26
> By default, variables render unmasked in your build outputs. If you need greater security for sensitive information, such as passwords, use secrets instead. For more information, see [AUTOTITLE](/actions/security-for-github-actions/security-guides/about-secrets).
Copy file name to clipboardExpand all lines: content/actions/how-tos/security-for-github-actions/security-guides/using-secrets-in-github-actions.md
+6-51Lines changed: 6 additions & 51 deletions
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Using secrets in GitHub Actions
3
3
shortTitle: Using secrets
4
-
intro: 'Secrets allow you to store sensitive information in your organization, repository, or repository environments.'
4
+
intro: 'Learn how to create secrets at the repository, environment, and organization levels for {% data variables.product.prodname_actions %} workflows.'
{% data reusables.actions.enterprise-github-hosted-runners %}
23
-
24
-
For general information about secrets, see [AUTOTITLE](/actions/security-for-github-actions/security-guides/about-secrets).
25
-
26
22
## Creating secrets for a repository
27
23
28
24
{% data reusables.actions.permissions-statement-secrets-variables-repository %}
@@ -45,8 +41,6 @@ If your repository has environment secrets or can access secrets from the parent
45
41
46
42
{% cli %}
47
43
48
-
{% data reusables.cli.cli-learn-more %}
49
-
50
44
To add a repository secret, use the `gh secret set` subcommand. Replace `secret-name` with the name of your secret.
51
45
52
46
```shell
@@ -172,6 +166,8 @@ You can check which access policies are being applied to a secret in your organi
172
166
> * Secrets are not automatically passed to reusable workflows. For more information, see [AUTOTITLE](/actions/using-workflows/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow).
173
167
> {% data reusables.actions.about-oidc-short-overview %}
174
168
169
+
> [!WARNING] Mask all sensitive information that is not a {% data variables.product.prodname_dotcom %} secret by using `::add-mask::VALUE`. This causes the value to be treated as a secret and redacted from logs.
170
+
175
171
To provide an action with a secret as an input or environment variable, you can use the `secrets` context to access secrets you've created in your repository. For more information, see [AUTOTITLE](/actions/learn-github-actions/contexts) and [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions).
176
172
177
173
{% raw %}
@@ -240,19 +236,7 @@ steps:
240
236
241
237
{% endraw %}
242
238
243
-
## Limits for secrets
244
-
245
-
You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets.
246
-
247
-
A workflow created in a repository can access the following number of secrets:
248
-
249
-
* All 100 repository secrets.
250
-
* If the repository is assigned access to more than 100 organization secrets, the workflow can only use the first 100 organization secrets (sorted alphabetically by secret name).
251
-
* All 100 environment secrets.
252
-
253
-
Secrets are limited to 48 KB in size. To store larger secrets, see the [Storing large secrets](#storing-large-secrets) workaround below.
254
-
255
-
### Storing large secrets
239
+
## Storing large secrets
256
240
257
241
To use secrets that are larger than 48 KB, you can use a workaround to store secrets in your repository and save the decryption passphrase as a secret on {% data variables.product.prodname_dotcom %}. For example, you can use `gpg` to encrypt a file containing your secret locally before checking the encrypted file in to your repository on {% data variables.product.prodname_dotcom %}. For more information, see the [gpg manpage](https://www.gnupg.org/gph/de/manual/r1023.html).
258
242
@@ -330,7 +314,8 @@ To use secrets that are larger than 48 KB, you can use a workaround to store sec
330
314
You can use Base64 encoding to store small binary blobs as secrets. You can then reference the secret in your workflow and decode it for use on the runner. For the size limits, see [AUTOTITLE](/actions/security-guides/using-secrets-in-github-actions#limits-for-secrets).
331
315
332
316
> [!NOTE]
333
-
> Note that Base64 only converts binary to text, and is not a substitute for actual encryption.
317
+
> * Note that Base64 only converts binary to text, and is not a substitute for actual encryption.
318
+
> * Using another shell might require different commands for decoding the secret to a file. On Windows runners, we recommend [using a bash shell](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell) with `shell: bash` to use the commands in the `run` step above.
334
319
335
320
1. Use `base64` to encode your file into a Base64 string. For example:
336
321
@@ -374,33 +359,3 @@ You can use Base64 encoding to store small binary blobs as secrets. You can then
374
359
run: |
375
360
openssl x509 -in cert.der -inform DER -text -noout
376
361
```
377
-
378
-
> [!NOTE]
379
-
> Using another shell might require different commands for decoding the secret to a file. On Windows runners, we recommend [using a bash shell](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell) with `shell: bash` to use the commands in the `run` step above.
380
-
381
-
## Redacting secrets from workflow run logs
382
-
383
-
{% data variables.product.prodname_actions %} automatically redacts the contents of all {% data variables.product.prodname_dotcom %} secrets that are printed to workflow logs.
384
-
385
-
{% data variables.product.prodname_actions %} also redacts information that is recognized as sensitive, but is not stored as a secret. Currently {% data variables.product.prodname_dotcom %} supports the following:
> [!NOTE] If you would like other types of sensitive information to be automatically redacted, please reach out to us in our [community discussions](https://github.com/orgs/community/discussions?discussions_q=is%3Aopen+label%3AActions).
403
-
404
-
As a habit of best practice, you should mask all sensitive information that is not a {% data variables.product.prodname_dotcom %} secret by using `::add-mask::VALUE`. This causes the value to be treated as a secret and redacted from logs. For more information about masking data, see [AUTOTITLE](/actions/using-workflows/workflow-commands-for-github-actions#masking-a-value-in-a-log).
405
-
406
-
Redacting of secrets is performed by your workflow runners. This means a secret will only be redacted if it was used within a job and is accessible by the runner. If an unredacted secret is sent to a workflow run log, you should delete the log and rotate the secret. For information on deleting logs, see [AUTOTITLE](/actions/monitoring-and-troubleshooting-workflows/using-workflow-run-logs#deleting-logs).
intro: 'Find technical information about secrets in {% data variables.product.prodname_actions %}.'
5
+
versions:
6
+
fpt: '*'
7
+
ghec: '*'
8
+
ghes: '*'
9
+
---
10
+
11
+
## Naming your secrets
12
+
13
+
>[!TIP]
14
+
> To help ensure that {% data variables.product.prodname_dotcom %} redacts your secrets in logs correctly, avoid using structured data as the values of secrets.
15
+
16
+
The following rules apply to secret names:
17
+
18
+
{% data reusables.actions.actions-secrets-and-variables-naming %}
19
+
20
+
{% data reusables.codespaces.secret-precedence %} Similarly, if an organization, repository, and environment all have a secret with the same name, the environment-level secret takes precedence.
21
+
22
+
## Limits for secrets
23
+
24
+
You can store up to 1,000 organization secrets, 100 repository secrets, and 100 environment secrets.
25
+
26
+
A workflow created in a repository can access the following number of secrets:
27
+
28
+
* All 100 repository secrets.
29
+
* If the repository is assigned access to more than 100 organization secrets, the workflow can only use the first 100 organization secrets (sorted alphabetically by secret name).
30
+
* All 100 environment secrets.
31
+
32
+
Secrets are limited to 48 KB in size. To store larger secrets, see [AUTOTITLE](/actions/how-tos/security-for-github-actions/security-guides/using-secrets-in-github-actions#storing-large-secrets).
33
+
34
+
## When {% data variables.product.prodname_actions %} reads secrets
35
+
36
+
Organization and repository secrets are read when a workflow run is queued, and environment secrets are read when a job referencing the environment starts.
37
+
38
+
## Automatically redacted secrets
39
+
40
+
{% data variables.product.prodname_dotcom %} automatically redacts the following sensitive information from workflow logs.
| {% data variables.copilot.copilot_gpt_41 %} | 0 | 1 |
94
94
| {% data variables.copilot.copilot_gpt_4o %} | 0 | 1 |
95
-
| {% data variables.copilot.copilot_gpt_45 %} | 50 | Not applicable |
96
95
| {% data variables.copilot.copilot_claude_sonnet_35 %} | 1 | 1 |
97
96
| {% data variables.copilot.copilot_claude_sonnet_37 %} | 1 | Not applicable |
98
97
| {% data variables.copilot.copilot_claude_sonnet_37 %} Thinking | 1.25 | Not applicable |
99
98
| {% data variables.copilot.copilot_claude_sonnet_40 %} | 1 | Not applicable |
100
99
| {% data variables.copilot.copilot_claude_opus %} | 10 | Not applicable |
101
100
| {% data variables.copilot.copilot_gemini_flash %} | 0.25 | 1 |
102
101
| {% data variables.copilot.copilot_gemini_25_pro %} | 1 | Not applicable |
103
-
| {% data variables.copilot.copilot_o1 %} | 10 | Not applicable |
104
102
| {% data variables.copilot.copilot_o3 %} | 1 | Not applicable |
105
103
| {% data variables.copilot.copilot_o3_mini %} | 0.33 | 1 |
106
104
| {% data variables.copilot.copilot_o4_mini %} | 0.33 | Not applicable |
@@ -111,6 +109,6 @@ If you use **{% data variables.copilot.copilot_free_short %}**, you have access
111
109
112
110
Premium request usage is based on the model’s multiplier and the feature you’re using. For example:
113
111
114
-
***Using {% data variables.copilot.copilot_gpt_45 %} in {% data variables.copilot.copilot_chat_short %}**: With a 50× multiplier, one interaction counts as 50 premium requests.
112
+
***Using {% data variables.copilot.copilot_claude_opus %} in {% data variables.copilot.copilot_chat_short %}**: With a 10× multiplier, one interaction counts as 10 premium requests.
115
113
***Using {% data variables.copilot.copilot_gpt_41 %} on {% data variables.copilot.copilot_free_short %}**: Each interaction counts as 1 premium request.
116
114
***Using {% data variables.copilot.copilot_gpt_41 %} on a paid plan**: No premium requests are consumed.
0 commit comments