Using secrets in GItHub workflows for private repositories

user_1574294 0
Viewed 981

I'm trying to use the GitHub workflows with the secrets. My setup is:

  • Free plan
  • Private org
  • Private repo
  • Secret in the org scope

enter image description here

The problem is that the secret evaluates into an empty string when I use it like this:

echo ${{ secrets.CI_TOKEN }}

What's interesting is that it seems like the workflow code itself is perfectly legit because it starts evaluating the secret into *** when I override it in the repo scope.

enter image description here

Then I've noticed a possible cause of that problem. The org secrets UI is kind of contradictory. First it says that I can not use secrets for private repos on a free plan but then I can choose the third option and choose that private repos manually.

enter image description here

enter image description here

So I wonder whether the free plan actually supports secrets in private repos of private orgs when you select repos manually or not?

environment-variables github
2 Answers

I accidentally found some information on the repo secrets page:

enter image description here

And it turns out that selecting private repos manually for the org secret is just a broken and misleading UI. You can choose those private repos but it's not gonna work.

I think this UI should be reworked to exclude private repos from that list.

user_15742940

So I wonder are secrets supposed to work when you choose them manually or not?

For private repos, selecting them explicitely is needed.

The documentation also mentions:

With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.

Test them with:

steps:
  - shell: bash
    env:
      SUPER_SECRET: ${{ secrets.SuperSecret }}
    run: |
      example-command "$SUPER_SECRET"
VonC_63090
Related