3.3. Secrets and Variables
💡 First Principle: Secrets and variables are the same shape — key/value pairs scoped to org, repository, or environment — but they differ in one decisive way: secrets are encrypted, masked in logs, and never returned by the API, while variables are plaintext configuration. Choosing wrongly either leaks a credential or needlessly hides a hostname.
Why care: scope is blast radius. An organization secret readable by 400 repositories is 400 chances to exfiltrate it; the same credential as an environment secret behind required reviewers is reachable only by an approved deployment job. The exam tests this as precedence puzzles ("which value does the job see?") and as design questions ("where should this credential live?").
⚠️ Common Misconception: "Organization secrets are automatically available everywhere in the org." Every organization secret carries an access policy — all repositories, all private repositories, or a selected list — and a repository outside that policy simply never receives it. Combined with the precedence order above, this produces the classic silent failure: ${{ secrets.MISSING }} evaluates to an empty string, and the step fails downstream with a confusing authentication error rather than a missing-secret error.
