> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Use 1Password to broker access to secrets in GitHub Actions at runtime (public preview)

> Learn how to configure GitHub Actions workflows to retrieve secrets from 1Password Environments at runtime.

export const StatusBadge = ({children}) => <span className="op-status-badge not-prose">{children}</span>;

<StatusBadge>Public Preview</StatusBadge>

If an administrator has [connected your GitHub organization to your 1Password Business account](/brokered-access), you can use 1Password to broker access to secrets from your 1Password Environments in your organization's GitHub Actions workflows at runtime.

## Step 1: Set up an Environment

To configure the variables you need to use in a GitHub Actions workflow, make sure you have the [latest version of the 1Password desktop app](https://support.1password.com/update-1password/), then create a new [1Password Environment](/environments#create-an-environment) with your variables or [add your variables](/environments#add-variables-to-an-environment) to an existing Environment.

## Step 2: Connect your Environment to your GitHub Actions workflow

After you've set up an Environment and added your secrets, you can connect the Environment to your GitHub Actions workflow:

1. Open your Environment, then select **Connect** in the GitHub Actions section.
   <Tip>
     If you've already connected your Environment to a workflow, select
     **Connect** instead, then select **Connect** in the GitHub Actions section.
   </Tip>
2. Select the integration field, then choose the integration for the GitHub organization you need.
3. Enter the name of the repository where your workflow needs to run.
4. (Optional) Specify if you want to restrict access to a specific GitHub Actions workflow, environment, or branch in your repository.
5. Select **Add workflow**.

## Step 3: Modify your GitHub Actions workflow

After you've connected your Environment to GitHub Actions, copy the snippet from the 1Password desktop app and include it in a GitHub Actions workflow in order to reference any secrets in your Environment.

You can choose from two methods to reference variables in your workflow:

* If you include `export-env: "true"` as an [import parameter <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepswith) to the step you copied into your workflow, you can reference the variables with the following structure: `${{ env.<variable-name> }}`
* If you add a [unique identifier <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsid) to the step you copied into your workflow, you can reference the variables with the following structure: `${{ steps.<id>.outputs.<variable-name> }}`

The specific steps you'll need to follow will vary depending on your workflow setup. Refer to the [GitHub Actions documentation <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/) for more information on how to use workflows.

## Usage example

The following example shows how to use 1Password Credential Broker to load a username and token variable from an Environment, then use them to sign in to Docker Hub.

```yaml config.yml theme={null}
on: push
name: Deploy app

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v3

      - name: Load Docker credentials
        id: load-docker-credentials
        uses: 1password/load-secrets-action@v5
        with:
          export-env: true
        env:
          OP_WORKLOAD_ID: <your-workload-id>
          OP_ENVIRONMENT_ID: <your-environment-id>
          OP_INTEGRATION_KEY: ${{ secrets.OP_INTEGRATION_KEY }}

      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ env.DOCKERHUB_USERNAME }}
          password: ${{ env.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          push: true
          tags: acme/app:latest
```

## Get help

If you don't see GitHub Actions as a destination in the 1Password desktop app, make sure your administrator has [connected your GitHub organization to your 1Password account](/brokered-access#github-actions).

If you see an OIDC-related error in your workflow log in GitHub, make sure you have `id-token: write` set in the `permissions` [within your workflow. <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions). This permission allows GitHub to generate a short-lived token that 1Password uses to identify your workflow before supplying your secrets at runtime.

## Learn more

* [1Password Environments](/environments)
* [1Password Credential Broker](/brokered-access)
* [Load Secrets from 1Password - GitHub Action <Icon icon="arrow-up-right-from-square" />](https://github.com/1password/load-secrets-action)


## Related topics

- [Allow your team to use 1Password to broker access to secrets in their workflows (public preview)](/brokered-access.md)
- [Use 1Password to broker access to secrets in custom workflows at runtime (public alpha)](/brokered-access/custom-workflow.md)
- [Load secrets from 1Password into GitHub Actions](/ci-cd/github-actions.md)