workflow

`env:`

Defines environment variables for a scope. Declared at the workflow, job, or step level and read back via the `env` context or as real environment variables inside `run:` scripts.

Syntax

env:
  KEY: value

Common values / subkeys

Value / Subkey	Purpose
workflow-level env	Defaults for every job in the file
job-level env	Defaults for every step in a job
step-level env	Only for that step's run
${{ env.NAME }}	Read the value in an expression
$GITHUB_ENV	Append `KEY=value` here to expose to later steps

Examples

env:
  NODE_ENV: production
  API_URL: https://api.example.com

Workflow-wide defaults

steps:
  - run: echo "$MY_VAR"
    env:
      MY_VAR: ${{ secrets.TOKEN }}

Injecting a secret via env avoids expression-injection in the script body

- run: echo "BUILD_ID=$GITHUB_RUN_ID" >> "$GITHUB_ENV"
- run: echo ${{ env.BUILD_ID }}

Persist a value into env for later steps

- if: env.APP == 'web'
  run: echo web build

Guard a step on an env value

Gotcha

Inside `run:` reference values as `$VAR` (bash) or `$env:VAR` (pwsh) — a bare `export FOO=...` in a shell is NOT visible to later steps; write to `$GITHUB_ENV` instead.

Related keywords

${{ secrets.NAME }}

The `secrets` context exposes repository, environment, and organization secrets to workflow expressions. Values are masked in logs and are not passed to workflows triggered from forked PRs.

run:

Executes a shell command on the runner. Multi-line scripts run in a single shell invocation; the shell is chosen by `shell:` (or workflow `defaults`) and defaults to bash on Linux/macOS and pwsh on Windows.

${{ github }}

The `github` context exposes information about the workflow run, event payload, repository, and actor. It is available in most expression fields and is the primary source of triggering-event data.

on:

Declares the events that trigger the workflow. Accepts a single event, a list, or a map with per-event filters (branches, paths, tags, types).

permissions:

Controls the scopes granted to the automatically generated GITHUB_TOKEN. Can be set at the workflow or job level; the job-level block overrides the workflow default.

← All GitHub Actions syntax · Git commands · Cron syntax