secrets
${{ secrets.NAME }}
The `secrets` context exposes repository, environment, and organization secrets to workflow expressions. Values are masked in logs and are not passed to workflows triggered from forked PRs.
${{ secrets.<NAME> }}Common values / subkeys
| Value / Subkey | Purpose |
|---|---|
| secrets.GITHUB_TOKEN | Auto-provisioned token scoped by `permissions:` |
| secrets.<NAME> | User-defined repo/env/org secret |
| secrets: inherit | Reusable-workflow call: forward every caller secret |
| ACTIONS_STEP_DEBUG | Set as a secret to true to enable debug logging |
Examples
- run: gh release create v1 --notes-file NOTES.md
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}Pass the token via env (never inline in the script)
jobs:
call:
uses: ./.github/workflows/deploy.yml
secrets: inheritForward all secrets to a reusable workflow
jobs:
call:
uses: org/repo/.github/workflows/wf.yml@v1
secrets:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}Pass named secrets explicitly
- run: curl -H "Authorization: Bearer $TOKEN" https://api.example.com
env:
TOKEN: ${{ secrets.API_TOKEN }}Inject a secret via env to avoid script injection
Gotcha
Secrets do NOT propagate to reusable workflows automatically — use `secrets: inherit` or a named `secrets:` map; secrets are also unavailable to workflows triggered by `pull_request` from a fork.
Related keywords
permissions:
Controls the scopes granted to the automatically generated GITHUB_TOKEN. Can be set at the workflow or job level; the job-level block overrides the workflow default.
uses: <workflow_call>
Reusable workflows are files that declare `on: workflow_call` and can be invoked as a job in another workflow. The caller passes typed `with:` inputs and either inherits or explicitly forwards secrets.
${{ vars.* }} / ${{ inputs.* }}
`vars` exposes non-secret configuration variables defined at the repository, environment, or organization level. `inputs` exposes typed parameters passed to `workflow_dispatch`, `workflow_call`, or composite actions.