World map

 

BM

World 7: Robots: Actions & CI/CD

Secrets, variables, environments

You will learn: where to keep keys and settings, so workflows can use them safely.

The problem

Your deploy needs a Cloudflare token. Paste it into ci.yml? Anyone who can read your repo would see it. Where should it go?

Watch

Run log
echo "Token: $CLOUDFLARE_API_TOKEN"
Token: ***

A secret: A password, API key or token. Whoever has it can get in. waits, locked, in your repo settings. A workflow reads it by name, like ${{ secrets.MY_TOKEN }}. Printed by mistake? The log shows ***. Still, never print it.

Watch

Not every setting is secret. A site address is fine to show. Store it as a variable (configuration variable): A plain workflow setting that is not secret, like a site address., and read it as ${{ vars.SITE_URL }}. Sort these.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      An environment: A named place you deploy to, like production, with its own secrets and rules. is a named place you deploy to, like production. It can hold its own secrets. It can wait for a person to approve. Put a guarded deploy in order.

      First step at the top. Put these in order. Use the arrows, or drag.

      • The new site goes live
      • The job gets the production secrets
      • The deploy job starts, then waits
      • A reviewer checks it and approves

      Try it

      Build the deploy workflow. Keys must come from secrets.

      Tap blocks to add them. Put them in order.

      Blocks

      Your workflow

      Tap a block above to start.

      Workflow file .github/workflows/

      name: Deploy

      What runs

      Nothing to run yet.

      Predict

      A stranger opens a PR from their fork. Your workflow runs on it. Does it get your secrets?

      You did it!

      You can now keep keys safe in your workflows.

      Go deeper (optional)

      Secrets live at three levels: organization, repository and environment. Environment secrets only reach jobs that use that environment. Environment rules can also limit deploys to main. On GitHub’s free plan, environments only work in public repos.