Skip to content

Organization Secret

Definition of a Secret on organization level, the following properties are supported:

Key Value Description Note
name string The name of the secret
selected_repositories list[string] List of repositories that can use the secret only applicable if visibility is set to selected
value SecretValue The secret value
visibility string Controls which repositories can use the secret public, private or selected

The value should reference a credential provider instead of being written in clear text, see SecretValue.

Jsonnet Function

orgs.newOrgSecret('<name>') {
  <key>: <value>
}

Validation rules

  • a name that is not uppercase triggers an error, as GitHub normalizes secret names to uppercase
  • redacted secret values (********) trigger a validation info and will skip the secret during processing
  • visibility of private is not supported by GitHub with a billing plan of type free
  • specifying a non-empty list of selected_repositories while visibility is not set to selected triggers a warning

Example usage

orgs.newOrg('OtterdogTest') {
  ...
  secrets+: [
    orgs.newOrgSecret('TEST_SECRET') {
      selected_repositories+: [
        "test-repo"
      ],
      value: "pass:path/to/my/secret/value",
      visibility: "selected",
    },
  ],
  ...
}