A GitHub Actions secret is a stored repository value that a workflow can use without putting the value in its source file. This matters when a deployment needs an SSH private key, a Docker Hub token, or application settings. Keep those values out of Git repositories, and do not print them during a workflow run. section 4.1.2 section 4.1.5 section 7.3.1
To give a workflow SSH access to a virtual machine:
- Generate a new SSH key pair for this deployment rather than using your personal key. Put the public key on the virtual machine. section 4.1.2
- In the GitHub repository, open Settings → Secrets and Variables → Actions → New Repository Secret. Name the secret SSH_PRIVATE_KEY and paste in the private key’s contents. section 4.1.2
- Store the machine’s IP address as AKAMAI_INSTANCE_IP_ADDRESS. Refer to either stored value in workflow YAML with `${{ secrets.SECRET_NAME }}`. section 4.1.5
Use the secret during an NGINX installation
A workflow writes `${{ secrets.SSH_PRIVATE_KEY }}` to `~/.ssh/id_rsa`, sets the file mode to `600`, and uses `${{ secrets.AKAMAI_INSTANCE_IP_ADDRESS }}` as the SSH destination. Its next commands connect to the machine and install NGINX. The workflow contains references to the stored values, not the private key itself. section 4.1.5
Listing 4.4 Installing NGINX with GitHub Actions
name: Install NGINX
on:
workflow_dispatch:
push:
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Configure the SSH Private Key Secret
run: |
mkdir -p ~/.ssh/
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
- name: Set Strict Host Key Checking
run: echo "StrictHostKeyChecking=no" > ~/.ssh/config
- name: Install NGINX
run: |
export MY_HOST="${{ secrets.AKAMAI_INSTANCE_IP_ADDRESS }}"
ssh root@$MY_HOST sudo apt update
ssh root@$MY_HOST sudo apt install nginx -y
The workflow listing puts secret references alongside the SSH setup and remote installation commands. section 4.1.5
The same pattern extends to container deployments. A workflow can pass DOCKERHUB_USERNAME and DOCKERHUB_TOKEN to a Docker Hub login action before building and pushing an image. For a production Docker Compose deployment, it can also create a `.env` file from stored application secrets and copy that file to the virtual machine. Once created, that file needs its own care: encrypting it during transfer is not covered here, and the workflow includes a step to remove its local copy. section 7.3.1 section 7.3.3
Check that every name used in workflow YAML matches a stored repository secret. The pattern also works for other deployment credentials: a Kubernetes deployment workflow stores a kubeconfig as KUBECONFIG_SA, then writes its value to the runner’s kubectl configuration. section 7.3.1 section 8.5.2
