Back to Interview Prep

</>

Technology

GitHub Actions

Difficulty

Beginner

Experience

Fresher

Type

Technical

AutomateQA Team

QA Automation Engineers

June 20, 2026

Interview Question

How do you use secrets and environment variables in GitHub Actions?

Answer

Secrets and Environment Variables in GitHub Actions

GitHub Secrets — For Sensitive Values

Secrets are encrypted and never visible in logs. GitHub masks them automatically.

Adding Secrets

CODE

Repository → Settings → Secrets and variables → Actions → New repository secret

Name:  DB_PASSWORD
Value: mySecretP@ss123

Using Secrets in Workflows

YAML

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Login to Docker Hub
        run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin

      - name: Run tests with DB credentials
        run: mvn test
        env:
          DB_HOST:     ${{ secrets.DB_HOST }}
          DB_USER:     ${{ secrets.DB_USER }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

      - name: Deploy with API key
        run: ./deploy.sh
        env:
          API_KEY: ${{ secrets.PROD_API_KEY }}

Organization Secrets (Shared Across Repos)

CODE

Organization → Settings → Secrets → Available to all/selected repos
# Access the same way: ${{ secrets.ORG_SECRET_NAME }}

Environment Variables — For Non-Sensitive Config

Workflow-Level (All Jobs)

YAML

name: CI Pipeline
on: push

env:
  APP_NAME:    my-app
  JAVA_VERSION: '17'
  MAVEN_OPTS:  '-Xmx512m'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "Building ${{ env.APP_NAME }}"

Job-Level (One Job)

YAML

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      TEST_ENV: staging
      BROWSER:  chrome

    steps:
      - run: mvn test -Denv=$TEST_ENV -Dbrowser=$BROWSER

Step-Level (One Step Only)

YAML

steps:
  - name: Run API tests
    run: mvn test -Dsuite=api
    env:
      API_BASE_URL: https://staging.api.example.com
      API_TOKEN:    ${{ secrets.STAGING_API_TOKEN }}

GitHub Default Environment Variables

YAML

steps:
  - run: |
      echo "Repo:    $GITHUB_REPOSITORY"     # org/repo-name
      echo "Branch:  $GITHUB_REF_NAME"       # main
      echo "SHA:     $GITHUB_SHA"            # commit hash (full)
      echo "Actor:   $GITHUB_ACTOR"          # username who triggered
      echo "RunID:   $GITHUB_RUN_ID"         # unique run ID
      echo "RunNum:  $GITHUB_RUN_NUMBER"     # sequential build number
      echo "Workspace: $GITHUB_WORKSPACE"    # /home/runner/work/repo/repo

Dynamic Environment Variables (Between Steps)

YAML

steps:
  - name: Set version
    run: echo "VERSION=$(mvn help:evaluate -q -Dexpression=project.version -DforceStdout)" >> $GITHUB_ENV

  - name: Use version in next step
    run: echo "Building version $VERSION"    # ← available now
    # Also accessible as: ${{ env.VERSION }}

vars — Non-Secret Configuration Values (GitHub Variables)

CODE

Settings → Secrets and variables → Actions → Variables tab
Name: BASE_URL  Value: https://staging.automateqa.online

YAML

- run: mvn test -DbaseUrl=${{ vars.BASE_URL }}

Best Practices

YAML

# ❌ Never do this
- run: curl -H "Authorization: token hardcoded-secret-here" ...

# ✅ Always use secrets
- run: curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" ...

# GITHUB_TOKEN is auto-provided by GitHub (no setup needed)
# Has read/write access to the repo depending on permissions