GitHub Actions: Secrets & Artifacts

CI pipelines often need two things:

1. secure inputs (credentials)
2. portable outputs (build artifacts)

This tutorial shows best-practice patterns for GitHub Actions.

Learning outcomes

You’ll be able to:

• use secrets safely in workflows
• restrict secret usage with environments
• upload/download artifacts between jobs

1) Secrets basics

Create secrets from the repo UI:

• Settings → Secrets and variables → Actions → New repository secret

Use in YAML:

env:
  API_TOKEN: ${{ secrets.API_TOKEN }}

steps:
  - run: |
      echo "Calling API"
      curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com

Avoid accidental secret leaks

• don’t print ${{ secrets.* }}
• don’t enable verbose logs that include auth headers
• use least-privilege tokens

2) Environments for deployment gating

Environments add manual approvals and can scope secrets.

Example:

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
    steps:
      - run: echo "Deploying to production"
      - run: echo "Using secret ${{ secrets.DEPLOY_TOKEN }}"

3) Artifacts: share build outputs

Upload artifact:

- name: Upload build output
  uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: dist/

Download artifact in a later job:

- name: Download build output
  uses: actions/download-artifact@v4
  with:
    name: build-output
    path: ./dist

4) Multi-job workflow example

name: Build and Test

on:
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist

  test:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist
      - run: npm test

5) Best-practice checklist

• store credentials in secrets, not in repo files
• use environments to add approval gates for production
• use artifacts to pass build outputs between jobs
• avoid caching sensitive directories

Next steps

Continue with:

• Terraform fundamentals (plan/apply workflows)
• Ansible idempotent configuration management
• Jenkins pipelines for legacy CI