---
title: "GitHub Actions Secrets : The Way to Secure Your Automation"
description: "Learn how to leverage GitHub Actions Secrets and secure your automation without risking leaving secrets in your code!"
canonical: "https://adamtheautomator.com/github-actions-secrets/"
---

# GitHub Actions Secrets : The Way to Secure Your Automation

> Learn how to leverage GitHub Actions Secrets and secure your automation without risking leaving secrets in your code!

Source: https://adamtheautomator.com/github-actions-secrets/

---

ATA Learning

Tap to hide

[

ATA Learning

](/)

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Search for:  

*   [](https://twitter.com/adbertram)
*   [](https://github.com/Adam-the-Automator)
*   [](https://www.linkedin.com/company/adam-the-automator-llc)
*   [](/feed/)

![GitHub Actions Secrets : The Way to Secure Your Automation](https://adamtheautomator.com/wp-content/uploads/2022/08/GitHub-Actions-Secrets-The-Way-to-Secure-Your-Automation-.jpg)

# GitHub Actions Secrets : The Way to Secure Your Automation

[![](https://secure.gravatar.com/avatar/b4cd4a109fc359fca6ccc8a192dd75bf9a440677bb2a87da8c23f48d76b3bb39?s=192&d=mm&r=g)Edem Afenyo](https://adamtheautomator.com/author/edem-afenyo/)24 August 20227 min. read

Categories: [IT Ops](/category/it-ops/)

Tags:[GitHub](/tag/github/)

Table of Contents

*   [Prerequisites](#prerequisites)
*   [Creating GitHub Action Secrets](#creating-github-action-secrets)
*   [Creating Secrets For an Environment](#creating-secrets-for-an-environment)
*   [Creating a GitHub Action Workflow](#creating-a-github-action-workflow)
*   [Creating a Dockerfile for Automated Building](#creating-a-dockerfile-for-automated-building)
*   [Monitoring the Running GitHub Workflows](#monitoring-the-running-github-workflows)
*   [Viewing Logs for Encrypted Secrets](#viewing-logs-for-encrypted-secrets)
*   [Conclusion](#conclusion)

[Github Actions](https://docs.github.com/en/actions) are a way of automating processes related to the code in your [repositories](https://docs.github.com/en/get-started/quickstart/create-a-repo), from contributions to building and deployment. The problem with such automation is that secret data often needs to be stored somewhere to keep the wheels of automation turning. Need a way to secure data? [GitHub Actions Secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) is the way!

GitHub Action Secrets keeps sensitive data encrypted and away from your not-so-sensitive code, allowing you to automate with peace of mind.

Read on, and explore GitHub Action Secrets while you securely automate the building and pushing of a Docker image!

## Prerequisites

This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following:

*   A [GitHub](https://github.com/) account and a [reposit](https://docs.github.com/en/get-started/quickstart/create-a-repo)[o](https://docs.github.com/en/get-started/quickstart/create-a-repo)[ry](https://docs.github.com/en/get-started/quickstart/create-a-repo) – This tutorial uses a public repo named _ATA\_Pub_.
*   A [Docker Hub](https://hub.docker.com/) account and a [repository](https://docs.docker.com/docker-hub/#step-2-create-your-first-repository) for hosting built container images – This tutorial uses a repository named _oddjobsinc/ata-repo_.

## Creating GitHub Action Secrets

Securing sensitive information, like credentials, must always be a top priority. But how exactly do you secure them? By creating secrets, you secure your workflow and keep your [secrets](https://adamtheautomator.com/github-actions-environment-variables/) away from prying eyes.

Related:[Launching GitHub Actions Environment Variables and Secrets](https://adamtheautomator.com/github-actions-environment-variables/)

To secure your workflow with GitHub action secrets:

1\. Open your favorite web browser, log in to GitHub and navigate to your repository.

2\. Next, click Settings on your repository homepage to access the repository settings.

![Accessing the GitHub repository settings](https://adamtheautomator.com/wp-content/uploads/2022/08/image-330.png)

Accessing the GitHub repository settings

3\. Select the Secrets dropdown menu (left panel) under the Security section, and choose Actions. Doing so opens the Action secrets page, where you can create a new secret.

![Accessing the Action secrets](https://adamtheautomator.com/wp-content/uploads/2022/08/image-331.png)

Accessing the Action secrets

4\. Now, click New repository secret to create a secret that will be used for Actions on your GitHub repository, which is _ATA\_Pub_, in this case.

![Initiating creating a new secret](https://adamtheautomator.com/wp-content/uploads/2022/08/image-332.png)

Initiating creating a new secret

5\. Configure an action secret for the Docker Hub username with the following:

*   **Name** – Set a secret name for the Docker Hub username. But this tutorial’s choice is **DH\_USERNAME**.
    
*   **Value** – Provide your Docker Hub account’s username.
    
*   Click **Add secret** to finalize creating the secret.
    

![Creating a secret for the Docker Hub username](https://adamtheautomator.com/wp-content/uploads/2022/08/image-333.png)

Creating a secret for the Docker Hub username

6\. Click **New repository secret** again to create another secret for the Docker Hub password.

![Initiating creating a new secret](https://adamtheautomator.com/wp-content/uploads/2022/08/image-334.png)

Initiating creating a new secret

7\. Lastly, configure the new secret for your Docker Hub password:

*   **Name** – Specify a secret name for your Docker Hub password (**DH\_PASS**).
    
*   **Value** – Provide your Docker Hub password.
    
*   Click on **Add secret** to create the secret.
    

![Creating the secret for Docker Hub password](https://adamtheautomator.com/wp-content/uploads/2022/08/image-335.png)

Creating the secret for Docker Hub password

## Creating Secrets For an Environment

You’ve just created secrets for GitHub actions, but how about secrets for your environments? Environment secrets help secure automation related to specific [deployment environments](https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment).

Environments are only available for [public repositories](https://docs.github.com/en/repositories/creating-and-managing-repositories/about-repositories#about-repository-visibility) and can be protected as follows:

1\. Click Environments (left panel) on your repository’s settings page to list the environments available to your repository.

![Accessing the list of available environments ](https://adamtheautomator.com/wp-content/uploads/2022/08/image-336.png)

Accessing the list of available environments

2\. Next, click New environment to initiate creating an environment.

![Initiating creating an environment](https://adamtheautomator.com/wp-content/uploads/2022/08/image-337.png)

Initiating creating an environment

3\. **Name** the environment you prefer, and click Configure environment to configure a new one.

This tutorial uses **Staging** as the environment name.

![Naming the new environment](https://adamtheautomator.com/wp-content/uploads/2022/08/image-338.png)

Naming the new environment

4\. Now, click Add Secret under the Environment secrets section to create a secret for this new environment.

![Adding a secret to the new environment](https://adamtheautomator.com/wp-content/uploads/2022/08/image-339.png)

Adding a secret to the new environment

5\. Provide appropriate values for the Name and Value fields of the secret, and click Add secret to save the new secret. Secrets don’t always have to contain sensitive data, though they are always encrypted.

For instance, the build your Action was automating was configured based on the value of an environment variable. If so, you can create an environment secret named APP\_ENV that will have the value STAGING only when the app is built in the _Staging_ environment.

![Creating an environment secret](https://adamtheautomator.com/wp-content/uploads/2022/08/image-340.png)

Creating an environment secret

6.Lastly, navigate the Actions page to see the list of available secrets.

![Accessing the list of available secrets](https://adamtheautomator.com/wp-content/uploads/2022/08/image-331.png)

Accessing the list of available secrets

You should now see a list of secrets your actions can access, as shown below.

![Verifying available secrets](https://adamtheautomator.com/wp-content/uploads/2022/08/image-342.png)

Verifying available secrets

## Creating a GitHub Action Workflow

Whether you aim to secure sensitive information or an environment, you already know how to by creating secrets. But this time, you’ll put those secrets to the test and see how they work with GitHub action [workflow](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions). A workflow is a compilation of jobs (configurable automated process) defined in a YAML file.

To create a GitHub action workflow:

1\. Select the Code tab on your repository page to access the files in the repository (_ATA\_Pub)_, as shown below.

![Accessing the repository files](https://adamtheautomator.com/wp-content/uploads/2022/08/image-343.png)

Accessing the repository files

2\. Next, click the Add file dropdown button → Create new file to initiate adding a new workflow YAML file to the repository.

![Initiating adding a new file in the repository](https://adamtheautomator.com/wp-content/uploads/2022/08/image-344.png)

Initiating adding a new file in the repository

3\. Add the following code snippet into the new file to create a workflow with a login-action. GitHub allows you to specify placeholders for your secrets so you do not have to risk exposing the actual values in your workflow files.

The code below builds an image defined by a [Dockerfile](https://docs.docker.com/engine/reference/builder/) in your repository. Take note of the tags directive, which will be used to identify the images built by this workflow.

Related:[Using the Dockerfile ENTRYPOINT and CMD Instructions](https://adamtheautomator.com/dockerfile-entrypoint/)

```yaml
name: build custom python container

# Run the job in this workflow when commits are pushed to the main branch
on:
  push:
    branches:
      - 'main'

jobs:
  # Build and push a container on an ubuntu runner
  build-push:
    runs-on: ubuntu-latest
    steps:
      -
        # Check out the code with the latest version of the Dockerfile
        name: Checkout
        uses: actions/checkout@v3
      -
        # Login to DockerHub with your secrets
        name: Login to DockerHub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DH_USERNAME }}  # Placeholder for the login username on DockerHub
          password: ${{ secrets.DH_PASS }}      # Placeholder for the login password on Dockerhub
      -
        # Build and push the resulting image to the repo {{Docker-ID/repo-name}} on DockerHub automatically
        name: Build and push
        uses: docker/build-push-action@v3
        with:
          push: true
          tags: oddjobsinc/ata-repo:mypython-v1
```

4\. Now, provide a name for your workflow file, which should be in the _/.github/workflows/_ directory. This tutorial uses _workflow.yml_ for the workflow filename.

You can type the full path into the filename field, and GitHub formats the path accordingly, as shown below.

![Naming the workflow file](https://adamtheautomator.com/wp-content/uploads/2022/08/image-345.png)

Naming the workflow file

5\. Finally, click Commit new file to commit the _workflow.yml_ file directly to your main branch.

![Committing the workflow file to the main branch](https://adamtheautomator.com/wp-content/uploads/2022/08/image-346.png)

Committing the workflow file to the main branch

## Creating a Dockerfile for Automated Building

You’ve just created your workflow, but you still need to specify the contents of the image that the Action will build and push. So you’ll create a Dockerfile for automated building.

1\. Create a new file that will serve as the Dockerfile in your repository.

![Creating a Dockerfile](https://adamtheautomator.com/wp-content/uploads/2022/08/image-344.png)

Creating a Dockerfile

2\. Next, add the following code to the file, which contains instructions to create an image from the official python 3 image and upgrade the pip tool to the latest version.

```powershell
FROM python:3

RUN pip install --upgrade pip
```

3\. Name the file as _dockerfile_ in the main branch, as shown below.

![Naming the Dockerfile](https://adamtheautomator.com/wp-content/uploads/2022/08/image-348.png)

Naming the Dockerfile

4\. Now, leave the default commit message unchanged, and click Commit new file to commit the file to the main branch.

![Committing the Dockerfile](https://adamtheautomator.com/wp-content/uploads/2022/08/image-349.png)

Committing the Dockerfile

## Monitoring the Running GitHub Workflows

With all the resources in place, you must monitor the progress of an automatic Action. Monitoring workflows lets you see what works and what doesn’t in your workflow. This feature is a big help in debugging a failed workflow.

To monitor running GitHub workflows:

1\. Select the Actions tab to see a list of available workflows in your repository.

![Accessing all available workflows](https://adamtheautomator.com/wp-content/uploads/2022/08/image-350.png)

Accessing all available workflows

You’ll see a list of Action runs for All workflows like in the screenshot below.

Each run is named after the commit message that triggered the run. You’ll also see an amber spinner indicating the Action triggered by committing to the main branch is still running.

![Viewing the progress of an Action](https://adamtheautomator.com/wp-content/uploads/2022/08/image-351.png)

Viewing the progress of an Action

> _The Action is designed to run automatically on every push to the main branch. With that behavior, committing the Dockerfile with the web GitHub interface in the previous section should trigger the Action._

After a while, the progress symbol turns green, as shown below, or red, indicating the result of the Action run. In this case, the run was successful, and you can expect to find a container image in your DockerHub repository.

![Viewing a successful action run](https://adamtheautomator.com/wp-content/uploads/2022/08/image-352.png)

Viewing a successful action run

2\. Open the Docker Hub repository at _https://hub.docker.com/repository/docker/\\/<repo-name>_ in a new tab to confirm the automated build and push was successful.

Be sure to replace _<docker id>_ and _<repo-name>_ with your actual Docker ID and repository name. But for this tutorial, the complete URL is _https://hub.docker.com/repository/docker/oddjobsinc/ata-repo._

3\. Now, scroll to the Tags and Scans section to see a list of all images in your repository.

Below, you can see the tag mypython-v1, the latest image pushed to the repository.

![Listing automatically pushed images in a Docker Repository](https://adamtheautomator.com/wp-content/uploads/2022/08/image-353.png)

Listing automatically pushed images in a Docker Repository

## Viewing Logs for Encrypted Secrets

You now have a successful automated action without exposing sensitive data in your code. But what happens when the Action is logged? No worries! Your secrets are all encrypted. It’s time to view GitHub Action Secrets in the logs and see if what’s being logged is genuinely encrypted.

To view the logs for encrypted secrets:

1.  Click the workflow run you are interested in from the list under the _Actions_ tab to view further details about it. In this case, select **Create dockerfile**, as shown below

![Selecting an action run](https://adamtheautomator.com/wp-content/uploads/2022/08/image-354.png)

Selecting an action run

2\. Next, select the job name to bring up a summary of the steps taken to execute the job. In this tutorial, the job name is **build-push.**

GitHub also gives relevant information about the job, such as:

*   How long did the job completion take?
    
*   Where can the job definition be found?
    
*   What event triggers the job?
    

![Selecting a job for a summary view](https://adamtheautomator.com/wp-content/uploads/2022/08/image-355.png)

Selecting a job for a summary view

3\. Select Login to DockerHub for a list of related log entries for the login step. But you can also select any step you like.

![Selecting a step to view](https://adamtheautomator.com/wp-content/uploads/2022/08/image-356.png)

Selecting a step to view

4\. Finally, select the Run docker/login-action@v2 log entry to reveal multiple related log entries. The fact that this entry can be expanded is given away by the dropdown symbol and the apparent jump in numbering, as shown below.

![Viewing the logs related to a step](https://adamtheautomator.com/wp-content/uploads/2022/08/image-357.png)

Viewing the logs related to a step

The expanded list in the screenshot below shows that the username and password were logged but cannot be read. Why? GitHub automatically protects data defined as secrets all the way.

This feature helps you avoid exposing them in plain text workflow files while keeping them encrypted in the logs.

![Viewing hidden credentials](https://adamtheautomator.com/wp-content/uploads/2022/08/image-358.png)

Viewing hidden credentials

## Conclusion

By coming this far, you have learned to create GitHub Action Secrets to avoid disclosing sensitive data in your Actions on GitHub. Not only that. You also learned to secure your automation.

Why not deepen your automation game by learning to create Slack Bot to invoke GitHub Actions?

Related:[Perfectly Create Slack Bot to Invoke GitHub Actions via Hubot](https://adamtheautomator.com/create-slack-bot/)

Share this article

[Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fgithub-actions-secrets%2F&text=GitHub%20Actions%20Secrets%20%3A%20The%20Way%20to%20Secure%20Your%20Automation)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fgithub-actions-secrets%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fgithub-actions-secrets%2F)

## Related Posts

![](https://adamtheautomator.com/wp-content/uploads/2023/11/github-arc.jpg)

### [Using GitHub ARC to run Self-Hosted Runners on Kubernetes](/github-arc/)

Maximize workflow efficiency with GitHub ARC: deploy, configure, and test self-hosted runners on Kubernetes seamlessly in this ATA tutorial!

![](https://adamtheautomator.com/wp-content/uploads/2022/08/The-Secret-to-Unleashing-PowerShell-GitHub-Abilities.jpg)

### [The Secret to Unleashing PowerShell GitHub Abilities](/powershell-github/)

In this deep dive, learn how to use PowerShell GitHub abilities to take your workflow to the next level and automate everything!

![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-4.png)

### [Migrate from EWS to Microsoft Graph API](/migrate-ews-microsoft-graph-api/)

Move EWS mailbox automation to Microsoft Graph with a practical inventory, permissions, PowerShell SDK, and cutover validation checklist.

## Categories

*   [IT Ops](/category/it-ops/)
*   [Cloud](/category/cloud/)
*   [DevOps](/category/devops/)
*   [Home Ops](/category/home-ops/)
*   [Information Security](/category/infosec/)
*   [Software Development](/category/software-development/)

## Site

*   [Home](/)
*   [Tutorials](/tutorials/)
*   [Instructors](/author/)
*   [Advertising](/advertising/)
*   [Recommended Resources](/resources/)
*   [About Adam](/about-adam/)

Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)