Workflow secrets are sensitive credentials made available to an automated CI/CD job, such as API keys, cloud tokens, signing keys, or service passwords. In systems like GitHub Actions, they are usually injected only when a workflow runs in a trusted repository context and are meant to let automation deploy code, publish packages, or call private APIs without exposing the raw value in the repository.
They matter because any job that can read a secret can usually use it as that job’s identity. Attackers look for trust-boundary mistakes: a workflow triggered by an issue, comment, or pull request may later check out attacker-controlled code or process untrusted data while still carrying secrets. If that happens, the secret can be leaked through logs, network requests, artifacts, or a compromised runner. Defenders reduce risk with least-privilege tokens, short-lived credentials, separation of untrusted and privileged jobs, and careful handling of triggers such as pull_request_target.