Secrets at repository, environment, and organization level

Create secrets at the repository, environment, or organization level; in organization repositories this requires admin access. Organization secrets carry an access policy — all repositories, private repositories only (the default), or a selected list of repositories. With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository; they are also not automatically passed to reusable workflows and are unavailable to workflows triggered by Dependabot events. Reference secrets through the secrets context, for example ${{ secrets.SuperSecret }}, as an action input or environment variable; an unset secret evaluates to an empty string. Secrets cannot be referenced directly in if: conditionals — set them as job-level environment variables and reference those instead. Mask any sensitive value that is not a GitHub secret with ::add-mask::VALUE so it is redacted from logs, avoid passing secrets on the command line where ps or security audit events can expose them, and quote shell variables that hold secrets. Where a cloud provider supports OpenID Connect, configure OIDC authentication instead of storing long-lived credentials as secrets. Scope: GitHub Actions. Reviewed October 4, 2026.