A secret named 'DEPLOY_KEY' exists both as a repository secret and as a secret on the 'production' environment with different values. A job sets 'environment: production'. Which value does secrets.DEPLOY_KEY resolve to?
Select an answer to reveal the explanation.
Short Explanation and Infographic
When a job targets an environment, environment secrets override repository secrets with the same name. That lets production credentials differ from default repository secrets.
Full explanation below image
Full Explanation
Secret precedence allows more specific scopes to override broader ones. For a job with environment: production, a production environment secret named DEPLOY_KEY shadows a repository-level DEPLOY_KEY. Organization secrets can also factor into availability based on repo access policies, but environment secrets are the usual way to isolate production credentials. GitHub does not fail the workflow merely because the same name exists at two levels, nor does it concatenate values. Design tip: use environment secrets for production and repository secrets for non-production shared defaults, or use distinct names to reduce confusion. Remember protection rules may pause the job before secrets are available to steps pending approval.