Pathwise

Manuals / CI/CD Pipelines / Chapter 4

B · Security & Config · intermediate · Week 2–3 · Chapter 4 of 12

Secrets & environment variables

Secrets never in code or logs. GitHub Secrets, environments, and OIDC for cloud — the safe patterns.

Path progress
27%

Step 1 of 4

Add a repository secret

Settings → Secrets → Actions. Reference as ${{ secrets.API_TOKEN }} in workflow.

Add a repository secretDrag stickies · tap for tips
Study mapDrag stickies · tap for tipsKeep it shortdrag · tap →Name the waitdrag · tap →Scope locatorsdrag · tap →Trace when stuckdrag · tap →One browser firstdrag · tap →Isolate statedrag · tap →Assert the UIdrag · tap →Retry wiselydrag · tap →Seed datadrag · tap →Close the loopdrag · tap →Keep it shortdrag · tap →Name the waitdrag · tap →Scope locatorsdrag · tap →Trace when stuckdrag · tap →One browser firstdrag · tap →Isolate statedrag · tap →Pathwise hackdrag · tap →Add a repository sdrag · tap →Try thisdrag · tap →Follow the dashed drag · tap →

Example

env:
  API_TOKEN: ${{ secrets.API_TOKEN }}
run: |
  curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com/health

Do this now

Add DUMMY_TOKEN secret. Echo in step with env: — confirm it masks in logs.

Was this step clear?
Chapter learning outcomes
  • Repository secrets
  • Environment secrets
  • Masking in logs
  • OIDC awareness

Clear these before you leave

Side quest

Leak drill

Search repo history for accidental keys — gitleaks or manual. Document clean bill.