GitHub Actions secrets management with environments

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    # Environment secrets: only available to this job
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        run: ./deploy.sh
        env:
          # These only exist in the 'staging' environment
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}

  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment: production  # Has required reviewer + branch protection
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        env:
          # Different secrets from 'production' environment
          DATABASE_URL: ${{ secrets.DATABASE_URL }}  # Different value
          DEPLOY_KEY: ${{ secrets.PROD_DEPLOY_KEY }}
        run: ./deploy.sh production

  # Pull request jobs should NOT use environment secrets
  test:
    runs-on: ubuntu-latest
    # No 'environment:' — only has repository-level secrets
    steps:
      - run: echo "No production secrets available here"

# Set environment secrets via gh CLI
gh secret set DATABASE_URL \
  --env staging \
  --body "postgresql://user:pass@staging-host/db"

gh secret set DATABASE_URL \
  --env production \
  --body "postgresql://user:prod-pass@prod-host/db"

# List secrets per environment
gh secret list --env staging
gh secret list --env production