Manage Secrets and Variables
Create a workspace secret or variable, bind it to a workflow step, replace its value, or delete it safely.
Use a variable for readable configuration and a secret for a credential. Both are available to projects in the workspace.
Before you begin
You need access to workspace secret and variable settings. To replace or delete a value, you also need its exact key.
Create the values
- Open Settings → Variables in the workspace.
- Select Create variable.
- Enter
DEPLOY_TARGETas the key andstagingas the value. - Save the variable.
- Open Settings → Secrets.
- Select Create secret.
- Enter
NPM_TOKENas the key and the token as the value. - Save the secret. Shipfox does not show its value again.
Bind and verify the values
Add this complete workflow to the project:
# yaml-language-server: $schema=https://www.shipfox.io/docs/workflow.schema.json
name: Verify workspace values
runner: shipfox
triggers:
manual:
source: manual
jobs:
check:
steps:
- env:
TARGET: "${{ vars.DEPLOY_TARGET }}"
TOKEN: "${{ secrets.NPM_TOKEN }}"
run: |
test -n "$TOKEN"
printf 'Target: %s\n' "$TARGET"Commit and push the workflow to the project's default branch, then start it from
the Workflows tab. The step must succeed and print Target: staging. It
checks that the token is present without printing the token.
If DEPLOY_TARGET is missing, Shipfox stops run creation. If NPM_TOKEN is
missing, Shipfox fails the step before the command runs. Fix the value in
workspace settings and start a new run. Context
availability lists the fields that
accept vars and secrets.
Replace a value
Replace a value without changing its key. Keep the old external credential active until workflows succeed with the new secret.
Find affected workflows
Search workflow files for the exact key. A secret appears as
${{ secrets.KEY }} or ${{ secrets.local.KEY }}. A variable appears as
${{ vars.KEY }}. Check all projects
in the workspace because workspace values are shared.
Replace the value
Open Settings → Secrets or Settings → Variables. Open the key's menu and select Edit value. Enter the full replacement value, then select Update secret or Update variable. The old secret value cannot be read back.
Verify the replacement
Start one representative workflow for each distinct use of the value. Confirm that every bound step succeeds and that logs do not expose a secret.
If the secret replaces an external credential, revoke the old credential only after these runs pass. To rename a key, create the new key, update and sync all workflow references, verify them, and then delete the old key.
Delete a value
Delete a workspace value only after no active workflow needs its key. A missed reference can stop run creation or fail a step.
Remove every dependency
Search every project for ${{ secrets.KEY }}, ${{ secrets.local.KEY }},
or ${{ vars.KEY }}. Replace
each match with a new key, remove the feature that needs the value, or
remove the workflow if it is no longer used.
Push the edits to each project's default branch and wait for every affected workflow to sync. Check active runs before deleting a secret that a pending step may still request.
Delete the value
Open Settings → Secrets or Settings → Variables. Open the key's menu, select Delete, and confirm the key shown in the dialog.
Verify the removal
Confirm that the key no longer appears in workspace settings. Start each affected workflow through its normal trigger. Confirm that run creation and all bound steps succeed without the key.
A missed variable reference fails run creation. A missed secret reference fails the step before its command runs. Restore the value if an urgent workflow still needs it, then remove that dependency before retrying deletion.