What's changed: New GH-100 Chapter 4 (governance & runners = distribute reusable components, org Actions policy [allow list/require SHA/fork-PR approval], runner groups/hosted-vs-self-hosted, IP allow lists/Azure private networking, performance monitoring [label mismatch/auto-scaling]; encrypted secrets = org/repo/environment scope and precedence, org-level central management, REST API automation, third-party vault integration (OIDC runtime fetch))
4.2Encrypted Secrets and Third-party Vault Integration
Understand defining the scope and access of secrets, configuring secrets at organization and repository levels, and integrating third-party vaults (secret management platforms)—from an admin’s view.
Workflows use secrets (API tokens, connection info) for deploys and external integrations. Admins govern these so they’re accessed only within a minimal scope and don’t leak. GH-100 tests secret scope and access, org/repo-level configuration, and third-party vault integration.
4.2.1Secret scope and access
GitHub Actions secrets scope at three levels—organization, repository, environment—with same-name resolution narrower scope wins (environment > repo > org) (shared with GH-200). Organization-level secrets can be shared across repos with restricted accessible repositories. Environment secrets combine with environment protection rules (required reviewers) to be used only for production deploys. Admins design to "expose minimal secrets only to the workflows that need them."
4.2.2Configuring at org/repo levels
Place common credentials (e.g., an internal registry token) at the organization level with access restricted to permitted repos—no per-repo duplication, and rotation updates in one place. Repo-specific values go at the repository level. Secrets auto-mask in logs, but don’t echo them or put them in expressions to prevent leakage. Secrets are creatable/updatable via the REST API (writes public-key encrypted), automating distribution/rotation across many repos (shared with GH-200).
4.2.3Third-party vault integration
If a company uses an external secret management platform (vault) (HashiCorp Vault, Azure Key Vault, AWS Secrets Manager), workflows can connect via OIDC and fetch secrets dynamically at runtime. This avoids storing secrets long-term in GitHub and keeps the company vault as the single source of truth—rotation and auditing centralize in the vault. Combined with OIDC (GH-200), long-lived cloud credentials are also eliminated.
Common: (1) Secrets scope at org/repo/environment; same name → narrower wins (environment > repo > org); org secrets restrict accessible repos. (2) Keep common credentials at the org level (easy rotation); prevent leaks by not echoing/embedding them; automate distribution/rotation via REST API. (3) Connect to a third-party vault via OIDC and fetch dynamically at runtime—don’t store long-term in GitHub.
Watch out: (1) Same-name secrets: narrower scope (environment) wins—mind unintended overrides. (2) Restrict which repos can access org secrets (don’t expose to all). (3) Auto-masking isn’t foolproof—transformed output can leak. (4) Vault integration exists to "not store long-term in GitHub"—combine with OIDC to eliminate long-lived credentials too.
4.2.4Section summary
- Secrets scope at org/repo/environment; narrower wins; org secrets restrict accessible repos
- Keep common credentials at org level; automate distribution/rotation via REST API; don’t echo/embed
- Connect to a third-party vault via OIDC and fetch dynamically—don’t store long-term in GitHub
- Combine with OIDC to eliminate long-lived cloud credentials too
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to centrally manage a deploy token shared across repos, accessible only to permitted repos. Where do you put it?
Q2. When a same-named secret exists at org, repo, and environment levels, which is used?
Q3. You want a company vault (HashiCorp Vault, Azure Key Vault) as the single source of truth, not storing secrets long-term in GitHub. Appropriate method?
Q4. You want to distribute the same secret to many repos and auto-rotate periodically. What do you use?
Q5. Which is a benefit of environment secrets?
Q6. Which is correct operation to prevent secret leakage?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.