How to Use the Command 'gh secret set' (with Examples)

The gh secret set command is part of the GitHub CLI, a powerful tool designed to allow developers and project managers to manage their GitHub repositories, workflows, and organizational settings directly from the command line. This particular command is used to create or update secrets within GitHub repositories or organizations. Secrets are encrypted environment variables that you can use in GitHub Actions to safely store sensitive data like API keys or other credentials without exposing them to end-users.

Use Case 1: Set a Secret for the Current Repository

Code:

gh secret set name

Motivation:

Sometimes developers need to store sensitive information, such as API keys or credentials, within a GitHub repository for use in automated processes like CI/CD pipelines. Using gh secret set, you can securely store this information as a secret in the repository’s settings.

Explanation:

• gh secret set is the command to set a secret.
• name is a placeholder for the name of the secret. This command will prompt the user to enter the value for the secret interactively. The actual sensitive value is never displayed or stored in plaintext.

Example Output:

? Value for secret 'name': <input value here>
✓ Set secret name for repository <username>/<repository>

Use Case 2: Set a Secret from a File for the Current Repository

Code:

gh secret set name < path/to/file

Motivation:

In scenarios where the secret value is a long string or contained in a file (such as private keys or certificates), manually entering the secret can be error-prone. This method allows you to set the secret using the contents of a file, ensuring accuracy and convenience.

Explanation:

• gh secret set initializes the command to set a secret.
• name specifies the name under which the secret will be stored.
• < path/to/file instructs the command to read the secret value from the specified file, where path/to/file is the relative or absolute path to the file containing the secret.

Example Output:

✓ Set secret name for repository <username>/<repository> using contents of file <path/to/file>

Use Case 3: Set a Secret for a Specific Repository

Code:

gh secret set name --body value --repo owner/repository

Motivation:

This use case is essential for users managing multiple repositories. It allows them to specify exactly which repository should receive the new secret, which is crucial when secrets vary from project to project or when managing multiple GitHub accounts.

Explanation:

• gh secret set triggers the command for setting a secret.
• name identifies the secret.
• --body value explicitly sets the secret’s value right in the command line without interactive input.
• --repo owner/repository specifies the target repository, where owner is the account name or organization and repository is the name of the repository.

Example Output:

✓ Set secret name for repository owner/repository

Use Case 4: Set an Organization Secret for Specific Repositories

Code:

gh secret set name --org organization --repos "repository1,repository2,..."

Motivation:

Frequently, organizations need to manage secrets at the organization level that are only visible to specific repositories. This functionality helps manage permissions and access controls efficiently, ensuring that only the necessary repositories have access to sensitive information.

Explanation:

• gh secret set initiates setting the secret.
• name is the identifier for the new secret.
• --org organization specifies the organization under which the secret will be stored.
• --repos "repository1,repository2,..." lists the repositories within the organization that will have access to the secret. These are comma-separated values of repository names.

Example Output:

✓ Set secret name for repositories: repository1, repository2, ...

Use Case 5: Set an Organization Secret with Specific Visibility

Code:

gh secret set name --org organization --visibility all|private|selected

Motivation:

This use case is ideal for organizations that need to manage the scope of accessibility for a secret. Whether you want the secret to be available to all repositories, only private ones, or a specific selection, this command provides the flexibility needed for proper secret management.

Explanation:

• gh secret set is used to initiate the command for setting a secret.
• name refers to the secret’s name.
• --org organization denotes the organization in which the secret will be stored.
• --visibility all|private|selected controls which repositories can access the secret. The all option makes it available to all repositories, private restricts it to private repos, and selected allows a custom selection of repositories.

Example Output:

✓ Set secret name with visibility set to 'all' for organization: organization

Conclusion

The gh secret set command provides a flexible and secure method to manage secrets in GitHub repositories and organizations. Through various options and arguments, users can precisely define the parameters and scope of their secrets, enhancing both security and operational efficiency within projects and organizations. Understanding and utilizing these use cases can significantly benefit any developer or manager involved in complex software development for teams using GitHub.