Question

An enterprise administrator creates an organization-level secret named DEPLOY_TOKEN and scopes it to "Selected repositories," adding only the repo `payments-api`. A developer in a different repo, `billing-web`, adds a workflow step that references `${{ secrets.DEPLOY_TOKEN }}`. When the workflow runs in `billing-web`, the value comes back empty and the deployment fails. What is the correct explanation and fix?

Accepted Answer

Organization secrets scoped to selected repositories are only available to those repositories; add `billing-web` to the secret's repository access list (or change scope to all repositories) so it can read DEPLOY_TOKEN.

Answer

Organization secrets cannot be read in workflows directly; the workflow must first copy DEPLOY_TOKEN into a repository-level secret using the REST API before each run.

Answer

The secret is empty because organization secrets require the workflow to declare them under a `secrets:` block at the job level, even for non-reusable workflows.

Answer

Selected-repository scope only restricts write access in the UI; the value is empty because the secret name must be prefixed with the organization slug, e.g. `secrets.ORG_DEPLOY_TOKEN`.