3.3.1. Scoping: Organization, Repository, Environment
💡 First Principle: The three scopes form a specificity ladder — environment beats repository beats organization for identically-named secrets — and only the environment tier adds gating, which is what turns a scope into a control.
| Aspect | Organization | Repository | Environment |
|---|---|---|---|
| Reach | Many repos, per access policy | One repository | One environment in one repository |
| Precedence | Lowest | Middle | Highest (wins) |
| Gating | None | None | Protection rules must pass first |
| Best for | Shared registry creds, org-wide config | Repo-specific tokens | Production credentials |
Variables (vars context) follow the identical three-tier precedence and are the right home for anything non-sensitive: region names, image tags, feature flags, API base URLs. Putting a hostname in a secret is a common anti-pattern — it can't be read back, can't be diffed, and gets masked out of logs where you needed to see it.
Limits are testable numbers: an organization may hold up to 1,000 secrets, a repository 100, and an environment 100; each secret is capped at 48 KB (larger payloads must be encrypted into a file, committed, and decrypted at run time with a smaller stored key). Secrets are encrypted with libsodium sealed boxes before they ever reach GitHub, and are decrypted only when delivered to a runner.
The design lesson the exam keeps returning to: production credentials belong in environment secrets, because that's the only tier where a required reviewer, a wait timer, or a branch policy stands between the credential and the job (2.3.3, 6.1.5). A repository secret named PROD_KEY is available to any workflow the repository runs, on any branch, immediately.
⚠️ Exam Trap: Secrets are not passed to workflows triggered by pull requests from forks — the token is read-only and secrets.* resolves empty. Answers proposing "add the secret at the org level so fork PRs can use it" are wrong at the mechanism level; the fix is a different trigger design (a labelled workflow_run, or a maintainer-approved run).
Reflection Question: Given identical values at all three tiers, environment wins. But the reason environment secrets are recommended for production isn't precedence — it's something else entirely. Name it, and explain what a repository secret cannot enforce.
