Require approval and environment-scoped secrets.
Section: Permissions and secrets
Use protected environments for deploys
yaml
yaml
jobs:
deploy:
environment: productionExplanation
Environments help gate deploys and scope secrets to staging, production, or other targets.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Permissions and secrets
Set least-privilege token permissions
Limit the default GITHUB_TOKEN scope.
Grant write access only where needed
Elevate token permissions on a specific job.
Expose a secret as an environment variable
Use the `secrets` context in step env.
Mask a dynamic sensitive value
Hide a generated or fetched secret from logs.
Configure AWS credentials via OIDC
Use the AWS credentials action without long-lived keys.