nerdexam
Microsoft

GH-200 · Question #87

Your organization is managing secrets using GitHub encrypted secrets, including a secret named SuperSecret. As a developer, you need to create a version of that secret that contains a different…

The correct answer is B. Create a duplicate entry for SuperSecret in the encrypted secret store and specify MyRepo as the. To override an organization-level secret with a different value for a specific repository, you create a scoped duplicate of that secret targeted at the repository, which takes precedence during workflow execution.

Implement and manage GitHub Actions workflows

Question

Your organization is managing secrets using GitHub encrypted secrets, including a secret named SuperSecret. As a developer, you need to create a version of that secret that contains a different value for use in a workflow that is scoped to a specific repository named MyRepo. How should you store the secret to access your specific version within your workflow?

Options

  • ACreate MyRepo_SuperSecret in GitHub encrypted secrets to specify the scope to MyRepo.
  • BCreate a duplicate entry for SuperSecret in the encrypted secret store and specify MyRepo as the
  • CCreate a file with the SuperSecret information in the .github/secrets folder in MyRepo.
  • DCreate and access SuperSecret from the secrets store in MyRepo.

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    79% (27)
  • C
    12% (4)
  • D
    6% (2)

Why each option

To override an organization-level secret with a different value for a specific repository, you create a scoped duplicate of that secret targeted at the repository, which takes precedence during workflow execution.

ACreate MyRepo_SuperSecret in GitHub encrypted secrets to specify the scope to MyRepo.

GitHub does not use naming conventions or prefixes like 'MyRepo_SuperSecret' to infer repository scope; secret scoping is configured through explicit repository access settings in the secrets management UI or API, not through name construction.

BCreate a duplicate entry for SuperSecret in the encrypted secret store and specify MyRepo as theCorrect

GitHub supports creating an organization-level secret with repository-scoped access, or creating a repository-level secret with the same name; by creating a duplicate SuperSecret entry and explicitly specifying MyRepo as its scope, the workflow in MyRepo will receive the repository-specific value while other repositories continue using the original organization-wide secret value.

CCreate a file with the SuperSecret information in the .github/secrets folder in MyRepo.

GitHub does not support storing secrets as plain files in a .github/secrets directory; all encrypted secrets must be stored through the GitHub encrypted secrets store to be securely injected into workflows.

DCreate and access SuperSecret from the secrets store in MyRepo.

Simply creating SuperSecret in MyRepo's secrets store describes a valid repository secret but does not explicitly address the scoping configuration needed to ensure the repository-level value overrides the existing organization-level secret for that specific repository.

Concept tested: GitHub encrypted secrets organization and repository scoping override

Source: https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions

Topics

#GitHub Actions Secrets#Secret Scoping#Repository-level Secrets#Workflow Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GH-200 Practice