Question

Your platform team stores a production deployment API key as an environment secret named DEPLOY_KEY scoped to an environment called production. The production environment is configured with a required reviewers protection rule. A workflow job references environment: production and needs DEPLOY_KEY. A developer triggers the workflow via a push to main. What happens to the job that consumes DEPLOY_KEY?

Accepted Answer

The job pauses and waits for a required reviewer to approve the deployment before it starts and DEPLOY_KEY becomes available.

Answer

The job runs immediately because environment secrets bypass protection rules when accessed within the same repository.

Answer

The job fails instantly because environment secrets cannot be used with required reviewer protection rules.

Answer

The job runs but DEPLOY_KEY resolves to an empty string until a reviewer manually injects the value.