How does GitHub Actions ensure security and access to hidden secret data such as keys and tokens?

GitHub Actions ensures the security of secret data through the "Secrets" mechanism — special environment variables that are stored encrypted and are only accessible during workflow execution. Access to them is restricted: they are not displayed in logs, and their values cannot be directly obtained from code.

When a workflow is triggered, secrets are automatically injected into the environment, and actions can use them, for example, for authentication or API access. To prevent leaks, GitHub prohibits secrets from being printed in logs and restricts access to them only to trusted workflows and branches.

Example of using a secret in a workflow:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Use secret
        run: echo "${{ secrets.MY_SECRET }}"

Here, MY_SECRET is a secret configured in the repository settings.