Question

Your organization stores a shared deployment token as an organization-level secret named DEPLOY_TOKEN. It is scoped with a visibility setting of 'Selected repositories' and only three repositories are currently listed. A team creates a new private repository, forks one of the three selected repositories into it, and their workflow that references ${{ secrets.DEPLOY_TOKEN }} returns an empty value. What is the correct explanation and fix?

Accepted Answer

The new repository is not in the org secret's selected-repositories list; add it to the list so the secret becomes available to that repository's workflows.

Answer

Organization secrets never propagate to private repositories; the secret must be recreated as a repository-level secret in every repo that needs it.

Answer

Forking automatically inherits the parent repository's org secret access; the empty value means the token itself expired and must be regenerated.

Answer

Organization secrets with 'Selected repositories' visibility are only available to public repositories, so the private repo must be made public to use it.