GitHub Actions secrets management with environments

<p>CI/CD pipeline needs secrets (API keys, deployment credentials) for different environments. Using repository-level secrets means production keys are accessible in all workflows including untrusted PRs. Need secret scoping by environment.</p>

<p>Use GitHub Environment secrets and Protection Rules to scope access:</p> <div class="highlight"><pre><span></span><code><span class="c1"># .github/workflows/deploy.yml</span> <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Deploy</span> <span class="nt">on</span><span class="p">:</span> <span class="w"> </span><span class="nt">push</span><span class="p">:</span> <span class="w"> </span><span class="nt">branches</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="nv">main</span><span class="p p-Indicator">]</span> <span class="nt">jobs</span><span class="p">:</span> <span class="w"> </span><span class="nt">deploy-staging</span><span class="p">:</span> <span class="w"> </span><span class="nt">runs-on</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ubuntu-latest</span> <span class="w"> </span><span class="c1"># Environment secrets: only available to this job</span> <span class="w"> </span><span class="nt">environment</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">staging</span> <span class="w"> </span><span class="nt">steps</span><span class="p">:</span> <span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">uses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">actions/checkout@v4</span> <span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Deploy to staging</span> <span class="w"> </span><span class="nt">run</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">./deploy.sh</span> <span class="w"> </span><span class="nt">env</span><span class="p">:</span> <span class="w"> </span><span class="c1"># These only exist in the 'staging' environment</span> <span class="w"> </span><span class="nt">DATABASE_URL</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">${{ secrets.DATABASE_URL }}</span> <span class="w"> </span><span class="nt">OPENAI_API_KEY</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">${{ secrets.OPENAI_API_KEY }}</span> <span class="w"> </span><span class="nt">DEPLOY_KEY</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">${{ secrets.STAGING_DEPLOY_KEY }}</span> <span class="w"> </span><span class="nt">deploy-production</span><span class="p">:</span> <span class="w"> </span><span class="nt">runs-on</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ubuntu-latest</span> <span class="w"> </span><span class="nt">needs</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">deploy-staging</span> <span class="w"> </span><span class="nt">environment</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">production</span><span class="w"> </span><span class="c1"># Has required reviewer + branch protection</span> <span class="w"> </span><span class="nt">steps</span><span class="p">:</span> <span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">uses</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">actions/checkout@v4</span> <span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">Deploy to production</span> <span class="w"> </span><span class="nt">env</span><span class="p">:</span> <span class="w"> </span><span class="c1"># Different secrets from 'production' environment</span> <span class="w"> </span><span class="nt">DATABASE_URL</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">${{ secrets.DATABASE_URL }}</span><span class="w"> </span><span class="c1"># Different value</span> <span class="w"> </span><span class="nt">DEPLOY_KEY</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">${{ secrets.PROD_DEPLOY_KEY }}</span> <span class="w"> </span><span class="nt">run</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">./deploy.sh production</span> <span class="w"> </span><span class="c1"># Pull request jobs should NOT use environment secrets</span> <span class="w"> </span><span class="nt">test</span><span class="p">:</span> <span class="w"> </span><span class="nt">runs-on</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ubuntu-latest</span> <span class="w"> </span><span class="c1"># No 'environment:' — only has repository-level secrets</span> <span class="w"> </span><span class="nt">steps</span><span class="p">:</span> <span class="w"> </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">run</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">echo "No production secrets available here"</span> </code></pre></div> <div class="highlight"><pre><span></span><code><span class="c1"># Set environment secrets via gh CLI</span> gh<span class="w"> </span>secret<span class="w"> </span><span class="nb">set</span><span class="w"> </span>DATABASE_URL<span class="w"> </span><span class="se">\</span> <span class="w"> </span>--env<span class="w"> </span>staging<span class="w"> </span><span class="se">\</span> <span class="w"> </span>--body<span class="w"> </span><span class="s2">"postgresql://user:pass@staging-host/db"</span> gh<span class="w"> </span>secret<span class="w"> </span><span class="nb">set</span><span class="w"> </span>DATABASE_URL<span class="w"> </span><span class="se">\</span> <span class="w"> </span>--env<span class="w"> </span>production<span class="w"> </span><span class="se">\</span> <span class="w"> </span>--body<span class="w"> </span><span class="s2">"postgresql://user:prod-pass@prod-host/db"</span> <span class="c1"># List secrets per environment</span> gh<span class="w"> </span>secret<span class="w"> </span>list<span class="w"> </span>--env<span class="w"> </span>staging gh<span class="w"> </span>secret<span class="w"> </span>list<span class="w"> </span>--env<span class="w"> </span>production </code></pre></div> <p>Environment Protection Rules (configure in GitHub UI Settings &gt; Environments): - Required reviewers: who must approve before the job runs - Deployment branches: only <code>main</code> can deploy to production - Wait timer: minimum delay before deployment (useful for production)</p> <p>PR workflows without <code>environment:</code> can only access repository-level secrets. Never put production database URLs in repository secrets.</p>