DevOps / Github Interview questions
When should you use repository secrets versus environment secrets in GitHub Actions?
A repository secret is available to every workflow run in that repository, regardless of which environment (if any) the job targets. That's appropriate for values that never differ by deployment target, like a shared internal API token used only for build-time steps.
An environment secret is scoped to a specific GitHub Environment (like staging or production) and is only exposed to jobs whose environment: key matches that name. This is the right choice whenever the same secret name needs a different value per target, such as a database connection string, since staging and production credentials should never be interchangeable.
Environment secrets also unlock protection rules unavailable to plain repository secrets: an environment can require manual approval or restrict which branches can deploy to it before its secrets are ever exposed to a running job, which is a meaningful safeguard for anything touching production.
More Related questions...
