Project113

CI/CD Secrets

Secrets let you store sensitive values like API keys, deployment credentials, and tokens securely. They are injected into your pipelines at runtime and are never exposed in logs.

Repository Secrets

Secrets scoped to a specific repository. Only pipelines running in that repository can access them.

  1. Navigate to your repository's Settings.
  2. Go to the Secrets section.
  3. Click Add Secret.
  4. Enter a name (used to reference the secret) and value.
  5. Optionally restrict which Docker images or pipeline events can access the secret.
  6. Click Save.

Using Secrets in Pipelines

Reference secrets in your pipeline configuration using from_secret inside a step's environment block:

steps:
  deploy:
    image: alpine
    environment:
      DEPLOY_TOKEN:
        from_secret: deploy_token
      API_KEY:
        from_secret: api_key
    commands:
      - echo "Deploying with token"
      - ./deploy.sh

The step-level secrets key is deprecated and does not inject secrets. Always use from_secret.

Secret Scoping

When adding a secret, you can restrict its availability:

  • Image filter — Only inject the secret into steps using specific Docker images.
  • Event filter — Only inject the secret for specific pipeline events. Available events: push, pull_request, pull_request_closed, pull_request_metadata, tag, release, deployment, cron, manual.