How does GitHub Actions handle secrets, and what is the maximum size of a secret value?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub encrypts secrets at rest and automatically redacts their values in log output — if a secret accidentally gets echoed to stdout, GitHub replaces it with asterisks. Each secret value can be up to 64 KB.
Full explanation below image
Full Explanation
GitHub Actions secrets are encrypted values stored securely in GitHub and injected as environment variables into workflow jobs. Key characteristics: (1) Secrets are encrypted at rest using libsodium sealed boxes with repository-specific keys. (2) Secret values are automatically masked/redacted in workflow logs — if a secret value appears in log output, GitHub replaces it with asterisks. (3) Maximum secret value size is 64 KB. (4) Secrets are not passed to workflows triggered by forks (security measure). (5) Secrets can be scoped at repository, environment, or organization level. If you need larger secret values, consider using a dedicated secrets manager (like HashiCorp Vault) and referencing it from your workflow.