Why is it a bad practice (and often ineffective) to branch on secret values using an if: condition like secrets.FEATURE_FLAG == 'true'?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Do not use secrets as feature flags in if:. Prefer vars for non-sensitive configuration. Secret values are masked and not intended for control-flow comparisons in conditions.
Full explanation below image
Full Explanation
GitHub documents limitations around secrets in conditional evaluation: secrets are designed to inject sensitive values into steps, not to drive boolean control flow. Comparing secrets in if: can yield unexpected empty behavior and undermines clarity. Configuration flags belong in variables (vars context), inputs, or env. Secrets remain masked in logs when printed, but control-flow use is still the wrong tool. It is false that secrets always evaluate true, that if: only allows runner properties, or that FEATURE_FLAG is a reserved name. A clean pattern is vars.ENABLE_CANARY == 'true' for non-sensitive toggles and secrets.API_TOKEN only inside env: for steps that call external APIs that require credentials.