我们经常发布文档更新,此页面的翻译可能仍在进行中。有关最新信息,请访问英文文档。如果此页面上的翻译有问题,请告诉我们
GitHub AE 目前是有限发行版。请联系我们的销售团队了解更多信息。

Encrypted secrets

Encrypted secrets allow you to store sensitive information in your organization or repository.

GitHub Actions 可用于 GitHub Free、GitHub Pro、组织的 GitHub Free,GitHub Team、GitHub Enterprise Cloud、GitHub Enterprise Server 、GitHub One 及 GitHub AE。 GitHub Actions 不适用于使用旧版按仓库计划的帐户所拥有的私有仓库。

本文内容

注意: 环境、环境保护规则和环境机密目前处于测试阶段,可能会改变。

About encrypted secrets

Secrets are encrypted environment variables that you create in an organization or repository. The secrets that you create are available to use in GitHub Actions workflows. GitHub uses a libsodium sealed box to help ensure that secrets are encrypted before they reach GitHub and remain encrypted until you use them in a workflow.

对于存储在组织级别的密码,可以使用访问策略来控制哪些仓库可以使用组织密码。 组织级密码允许在多个仓库之间共享密码,从而减少创建重复密码的需要。 在一个位置更新组织密码还可确保更改在使用该密码的所有仓库工作流程中生效。

Naming your secrets

The following rules apply to secret names:

  • Secret names can only contain alphanumeric characters ([a-z], [A-Z], [0-9]) or underscores (_). Spaces are not allowed.

  • Secret names must not start with the GITHUB_ prefix.

  • Secret names must not start with a number.

  • Secret names are not case-sensitive.

  • Secret names must be unique at the level they are created at. For example, a secret created at the repository level must have a unique name in that repository, and a secret created at the organization level must have a unique name at that level.

    If a secret with the same name exists at multiple levels, the secret at the lower level takes precedence. For example, if an organization-level secret has the same name as a repository-level secret, then the repository-level secret takes precedence.

To help ensure that GitHub redacts your secret in logs, avoid using structured data as the values of secrets. For example, avoid creating secrets that contain JSON or encoded Git blobs.

Accessing your secrets

To make a secret available to an action, you must set the secret as an input or environment variable in the workflow file. Review the action's README file to learn about which inputs and environment variables the action expects. For more information, see "Workflow syntax for GitHub Actions."

You can use and read encrypted secrets in a workflow file if you have access to edit the file. For more information, see "Access permissions on GitHub."

Warning: GitHub automatically redacts secrets printed to the log, but you should avoid printing secrets to the log intentionally.

You can also manage secrets using the REST API. For more information, see "Secrets."

Limiting credential permissions

When generating credentials, we recommend that you grant the minimum permissions possible. For example, instead of using personal credentials, use deploy keys or a service account. Consider granting read-only permissions if that's all that is needed, and limit access as much as possible. When generating a personal access token (PAT), select the fewest scopes necessary.

Creating encrypted secrets for a repository

要为用户帐户仓库创建密码,您必须是仓库所有者。 要为组织仓库创建密码,您必须具有管理员访问权限。

  1. 在 GitHub AE 上,导航到仓库的主页面。
  2. 在仓库名称下,单击 Settings(设置)仓库设置按钮
  3. 在左侧边栏中,单击 Secrets(密码)
  4. Click New repository secret.
  5. Type a name for your secret in the Name input box.
  6. Enter the value for your secret.
  7. Click Add secret.

If your repository can access secrets from the parent organization, then those secrets are also listed on this page.

Creating encrypted secrets for an organization

When creating a secret in an organization, you can use a policy to limit which repositories can access that secret. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories.

要在组织级别创建密码,必须具有管理员访问权限。

  1. 在 GitHub AE 上,导航到组织的主页面。
  2. 在组织名称下,单击 Settings(设置)组织设置按钮
  3. 在左侧边栏中,单击 Secrets(密码)
  4. Click New organization secret.
  5. Type a name for your secret in the Name input box.
  6. Enter the Value for your secret.
  7. From the Repository access dropdown list, choose an access policy.
  8. Click Add secret.

Reviewing access to organization-level secrets

You can check which access policies are being applied to a secret in your organization.

  1. 在 GitHub AE 上,导航到组织的主页面。
  2. 在组织名称下,单击 Settings(设置)组织设置按钮
  3. 在左侧边栏中,单击 Secrets(密码)
  4. The list of secrets includes any configured permissions and policies. For example: Secrets list
  5. For more details on the configured permissions for each secret, click Update.

Using encrypted secrets in a workflow

除了 GITHUB_TOKEN 以外,从复刻的仓库触发工作流程时密码不会传递给运行程序。

To provide an action with a secret as an input or environment variable, you can use the secrets context to access secrets you've created in your repository. For more information, see "Context and expression syntax for GitHub Actions" and "Workflow syntax for GitHub Actions."

steps:
  - name: Hello world action
    with: # Set the secret as an input
      super_secret: ${{ secrets.SuperSecret }}
    env: # Or as an environment variable
      super_secret: ${{ secrets.SuperSecret }}

Avoid passing secrets between processes from the command line, whenever possible. Command-line processes may be visible to other users (using the ps command) or captured by security audit events. To help protect secrets, consider using environment variables, STDIN, or other mechanisms supported by the target process.

If you must pass secrets within a command line, then enclose them within the proper quoting rules. Secrets often contain special characters that may unintentionally affect your shell. To escape these special characters, use quoting with your environment variables. For example:

Example using Bash

steps:
  - shell: bash
    env:
      SUPER_SECRET: ${{ secrets.SuperSecret }}
    run: |
      example-command "$SUPER_SECRET"

Example using PowerShell

steps:
  - shell: pwsh
    env:
      SUPER_SECRET: ${{ secrets.SuperSecret }}
    run: |
      example-command "$env:SUPER_SECRET"

Example using Cmd.exe

steps:
  - shell: cmd
    env:
      SUPER_SECRET: ${{ secrets.SuperSecret }}
    run: |
      example-command "%SUPER_SECRET%"

Limits for secrets

You can store up to 1,000 secrets per organization and 100 secrets per repository. A workflow may use up to 100 organization secrets and 100 repository secrets.

Secrets are limited to 64 KB in size. To use secrets that are larger than 64 KB, you can store encrypted secrets in your repository and save the decryption passphrase as a secret on GitHub. For example, you can use gpg to encrypt your credentials locally before checking the file in to your repository on GitHub. For more information, see the "gpg manpage."

Warning: Be careful that your secrets do not get printed when your action runs. When using this workaround, GitHub does not redact secrets that are printed in logs.

  1. Run the following command from your terminal to encrypt the my_secret.json file using gpg and the AES256 cipher algorithm.

    $ gpg --symmetric --cipher-algo AES256 my_secret.json
  2. You will be prompted to enter a passphrase. Remember the passphrase, because you'll need to create a new secret on GitHub that uses the passphrase as the value.

  3. Create a new secret that contains the passphrase. For example, create a new secret with the name LARGE_SECRET_PASSPHRASE and set the value of the secret to the passphrase you selected in the step above.

  4. Copy your encrypted file into your repository and commit it. In this example, the encrypted file is my_secret.json.gpg.

  5. Create a shell script to decrypt the password. Save this file as decrypt_secret.sh.

    #!/bin/sh
    
    # Decrypt the file
    mkdir $HOME/secrets
    # --batch to prevent interactive command
    # --yes to assume "yes" for questions
    gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" \
    --output $HOME/secrets/my_secret.json my_secret.json.gpg
  6. Ensure your shell script is executable before checking it in to your repository.

    $ chmod +x decrypt_secret.sh
    $ git add decrypt_secret.sh
    $ git commit -m "Add new decryption script"
    $ git push
  7. From your workflow, use a step to call the shell script and decrypt the secret. To have a copy of your repository in the environment that your workflow runs in, you'll need to use the actions/checkout action. Reference your shell script using the run command relative to the root of your repository.

    name: Workflows with large secrets
    
    on: push
    
    jobs:
      my-job:
        name: My Job
        runs-on: ubuntu-latest
        steps:
          - uses: actions/checkout@v2
          - name: Decrypt large secret
            run: ./.github/scripts/decrypt_secret.sh
            env:
              LARGE_SECRET_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}
          # This command is just an example to show your secret being printed
          # Ensure you remove any print statements of your secrets. GitHub does
          # not hide secrets that use this workaround.
          - name: Test printing your secret (Remove this step in production)
            run: cat $HOME/secrets/my_secret.json
    

此文档对您有帮助吗?

Privacy policy

帮助我们创建出色的文档!

所有 GitHub 文档都是开源的。看到错误或不清楚的内容了吗?提交拉取请求。

做出贡献

或, 了解如何参与。