Question

You are an organization admin at a company where dozens of repositories share a single deployment token. You store it as an organization-level secret named DEPLOY_TOKEN and set the repository access policy to "Selected repositories," choosing only three production repos. A developer in a fourth repository (not on the selected list) writes a workflow that references ${{ secrets.DEPLOY_TOKEN }}. When their workflow runs, what happens?

Accepted Answer

The secret resolves to an empty string in the fourth repository because it is not among the selected repositories granted access.

Answer

The workflow can read DEPLOY_TOKEN because organization secrets are automatically inherited by every repository regardless of the access policy.

Answer

The workflow fails validation at parse time with an error stating the secret does not exist before any job runs.

Answer

The fourth repository can read the secret only if a repository-level secret with the same name is also created to grant a grace period.