An organization wants to share a single API key required for their Actions workflows. They need to restrict its use to only a subset of repositories. Where should they configure the secrets to…

Question

Options

• ARepository secrets
• BEnvironment secrets
• COrganization secrets
• DDevelopment environment secrets

• A
  5% (3)
• B
  2% (1)
• C
  83% (50)
• D
  10% (6)

Explanation

Organization secrets (C) are the right choice because they let you define a single secret at the org level and explicitly control which repositories can access it - exactly what the question describes. This minimizes maintenance since you update the key in one place and adjust repository access without touching individual repos.

Repository secrets (A) require you to add the secret to every repo individually, meaning every rotation means N updates - the opposite of minimal maintenance. Environment secrets (B) scope secrets to deployment environments within a single repository, so they can't be shared across repos at all. Development environment secrets (D) is a distractor that doesn't correspond to a real GitHub Actions secrets tier.

Memory tip: Think of the three real tiers as a funnel - Organization (widest, shared, access-controlled) → Repository (one repo only) → Environment (one deployment environment within one repo). Whenever the question mentions "share across repos + restrict access," that's the Organization tier.

No community discussion yet for this question.