GitHub Actions Tutorial — Environment & Secrets
Chapter 6 — Environment & Secrets
Every workflow needs configuration — API keys, database URLs, feature flags, cloud credentials. GitHub Actions provides a layered system for managing environment variables and secrets, from simple key-value pairs to full deployment environments with protection rules.
In this chapter, you’ll learn how to pass configuration to your workflows securely and efficiently.
What You’ll Learn
- Setting environment variables at workflow, job, and step levels
- Storing and using encrypted secrets
- Understanding the automatic
GITHUB_TOKEN - Configuring deployment environments with protection rules
- Using OIDC for passwordless cloud authentication
Topics Covered
1. Environment Variables
Define variables at three scopes: workflow-wide, per-job, and per-step.
2. Secrets
Store sensitive data encrypted and access it securely in workflows.
3. GITHUB_TOKEN
The automatic token that every workflow gets — its permissions, scopes, and limitations.
4. Environments
Named deployment targets (staging, production) with protection rules and environment-specific secrets.
5. OIDC Tokens
Eliminate long-lived cloud credentials with OpenID Connect tokens for AWS, Azure, and GCP.
Practice
Test your understanding with hands-on exercises.
← Previous: Chapter 5: Steps & Actions
