Why might a job-level 'if: ${{ secrets.DEPLOY_KEY != '' }}' fail to behave as authors expect?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub intentionally limits how secrets work in if conditions so presence cannot be trivially probed; use environments, inputs, or vars for non-secret toggles.
Full explanation below image
Full Explanation
The secrets context is restricted in job if expressions to reduce secret enumeration and leakage risks. Comparing secrets to empty strings is a common anti-pattern that does not reliably implement feature flags. Prefer repository/organization variables (vars context), workflow inputs, or environment selection for non-sensitive toggles. Keep secrets for credentials only and gate jobs with environment protection rules when needed. Job if does support multiple contexts (github, needs, vars, etc.) but secrets should not be used as boolean configuration. Document team conventions so workflows use vars.ENABLE_DEPLOY rather than secret presence.