How to save github secrets content in a file in github action

Question

I was trying to do the following :

echo ${{secrets.key}} > myfile

But unfortunately, this doesn't work since myfile would be empty after this when i checked. How do i save the content of github secret into a file ?

Answer 1

You can first pass the secret to an env var, then echo it to the file, remember to quote the env var to prevent line feed from breaking the command.

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: print secrets
      env:
        MY_SECRET: ${{secrets.KEY}}
      shell: bash
      run: |
          echo "$MY_SECRET" >> config.ini
          cat config.ini

Answer 2

You can write your github actions secrets into files like this:

- name: write config files
  run: |
      printf '%s' '${{ secrets.mysecret }}' > some.conf
      printf '%s' '${{ secrets.foo }}' > more.conf

This is doesn't leak your secrets into log files because github actions automatically redacts each secret (with 3 asterisks) when logging.

There is no need to put your secret into an environment variable, first.

Note that using printf is superior over echo because that way you can't accidentally inject options to echo.

Also note that the secret is explicitly quoted such that whitespace (including newlines) in secrets properly end up in the resulting file.

---

Of course, if your secret contains single quotes then you need to approach this a bit differently, e.g. base64 encode your secret or something like that.