How do you use secrets such as API keys in GitHub Actions safely?
Store them under repository Settings, Secrets and variables, then read them in the workflow as secrets.NAME. GitHub masks their values in logs, and they are not passed to workflows from forks by default.
Explain it simply
A key hidden under the mat is not safe; a locker with a code is. Secrets are the locker.
Add the value in the repository settings. In the workflow, reference it with ${{ secrets.API_KEY }} and pass it to a step as an environment variable. GitHub hides the value if it appears in logs, but a careless echo that transforms it can still leak it. Pull requests from forks do not receive secrets, so an attacker cannot steal them with a malicious PR. Never write the key in the YAML file.
Example
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- run: ./deploy.sh
env:
API_KEY: ${{ secrets.API_KEY }}What to say in the interview
"I store secrets in repository or environment settings and reference them as secrets.NAME, passing them via env. GitHub masks them in logs and withholds them from fork pull requests. I never put the value in the workflow file or print it."