Docker and CI/CD · Junior · Question 48 of 75

How should a workflow access an API token for deployment?

✓Correct answer: From a repository secret: ${{ secrets.DEPLOY_TOKEN }}
2Hard-coded in the workflow file, since it's private
3From a committed .env file in the repository

Explanation

Secrets are encrypted, masked in logs and not passed to workflows from forks by default. Even better are short-lived credentials via OIDC.

Further reading

GitHub Docs: Using secrets in GitHub Actions ↗

Test yourself

Take the Docker and CI/CD · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.