context
${{ vars.* }} / ${{ inputs.* }}
`vars` exposes non-secret configuration variables defined at the repository, environment, or organization level. `inputs` exposes typed parameters passed to `workflow_dispatch`, `workflow_call`, or composite actions.
${{ vars.<NAME> }} ${{ inputs.<name> }} Common values / subkeys
| Value / Subkey | Purpose |
|---|---|
| vars.<NAME> | Non-secret config variable (visible in logs) |
| inputs.<name> | Typed input from workflow_dispatch / workflow_call / composite |
| type: string|boolean|number|choice|environment | Input types allowed on workflow_dispatch |
| required / default | Per-input required flag and default value |
Examples
on:
workflow_dispatch:
inputs:
env:
type: choice
options: [dev, prod]
required: true Typed manual input
run: deploy --env ${{ inputs.env }} --region ${{ vars.AWS_REGION }} Combine inputs and vars in a run step
on:
workflow_call:
inputs:
version: {required: true, type: string} Declare inputs for a reusable workflow
if: ${{ inputs.dry_run == true }} Boolean inputs from workflow_dispatch are true booleans
Gotcha
`vars` are NOT masked and are readable by anyone with workflow access — never store credentials there; boolean inputs may arrive as the string `'true'` when a reusable-workflow caller passes a stringified value.
Related keywords
${{ secrets.NAME }}
The `secrets` context exposes repository, environment, and organization secrets to workflow expressions. Values are masked in logs and are not passed to workflows triggered from forked PRs.
uses: <workflow_call>
Reusable workflows are files that declare `on: workflow_call` and can be invoked as a job in another workflow. The caller passes typed `with:` inputs and either inherits or explicitly forwards secrets.
${{ <expression> }}
GitHub Actions expressions are evaluated by the runner and interpolated into YAML values before shells see them. They support literals, operators, contexts, and a fixed set of functions — this is unrelated to Terraform's `${}` interpolation.
${{ github }}
The `github` context exposes information about the workflow run, event payload, repository, and actor. It is available in most expression fields and is the primary source of triggering-event data.