> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Provide access to secrets at runtime in GitHub Actions (public preview)

> Learn how to configure GitHub Actions workflows to retrieve secrets from 1Password Environments at runtime.

[1Password Credential Broker](https://1password.com/blog/introducing-1password-credential-broker) sits between your [GitHub Actions <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions) workflows and your credentials, supplying secrets at runtime only after confirming a workflow's identity. Secrets are only available for the duration of the job, and every request for access is recorded in your [audit log](https://support.1password.com/activity-log/).

To get started, an administrator must connect your organization's 1Password Business account to your GitHub organization. Developers can then configure a [1Password Enviroment](/environments) to use in GitHub Actions workflows for repositories within the connected GitHub organization.

## Requirements

Before you begin, an administrator must follow these steps to connect your organization's [1Password Business](https://1password.com/business-security) account to your GitHub organization hosted on GitHub.com. GitHub organizations hosted on [GitHub Enterprise Server <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/enterprise-server@latest/admin/overview/about-github-enterprise-server) or [GitHub Enterprise Cloud with data residency <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/enterprise-cloud@latest/admin/data-residency/about-github-enterprise-cloud-with-data-residency) aren't currently supported.

1. [Sign in](https://start.1password.com/signin) on 1Password.com, then select [**Developer**](https://start.1password.com/integrations/directory) in the sidebar.
2. Select **Set up an integration**, then select **GitHub Actions**.
   <Tip>
     If you've already added a GitHub organization and want to add another,
     select **Manage integration**, then select **Add Integration**.
   </Tip>
3. Enter a name for the integration and the name of the organization you want to connect, then select **Create integration**.
4. Add the `OP_INTEGRATION_KEY` name and token value to the list of [secrets in your GitHub organization. <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/en/codespaces/managing-codespaces-for-your-organization/managing-development-environment-secrets-for-your-repository-or-organization#adding-secrets-for-an-organization)

After your GitHub organization is connected, make sure you've installed the [1Password desktop app](https://1password.com/downloads), then [update to the latest version](https://support.1password.com/update-1password/) before you continue to step 1.

## Step 1: Create an Environment

To configure the variables you want to use in a GitHub Actions workflow, create a new [1Password Environment](/environments#create-an-environment) with your variables or [add the variables](/environments#add-variables-to-an-environment) to an existing Environnment.

## Step 2. Configure the GitHub Actions destination

After you've created an Environment and added your secrets, you can add the GitHub Actions destination to your Environment:

1. In your Environment, select the **Destinations** tab, then select **Configure destination** for GitHub Actions.
   <Tip>
     If you've already configured a destination for your Environment, select
     **New destination** instead.
   </Tip>
2. Select the integration field, then choose the integration for the GitHub organization you need.
3. Enter the name of the repository where your workflow needs to run.
4. (Optional) Specify if you want to restrict access to a specific GitHub Actions workflow, environment, or branch in your repository.
5. Select **Add destination**.

## Step 3: Update your GitHub Actions workflow

After you've added the GitHub Actions destination to your Environment, copy the snippet from the 1Password desktop app and include it in a GitHub Actions workflow in order to reference any secrets in your Environment.

You can choose from two methods to reference variables in your workflow:

* If you add a [unique identifier <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsid) to the step you copied into your workflow, you can reference the variables with the following structure: `${{ steps.<id>.outputs.<variable-name> }}`
* If you include `export-env: "true"` as an [import parameter <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepswith) to the step you copied into your workflow, you can reference the variables with the following structure: `${{ env.<variable-name> }}`

The specific steps you will need to follow will vary depending on your workflow setup. Refer to the [GitHub Actions documentation <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/actions/) for more information on how to use workflows.

## Usage example

The following example shows how to use 1Password Credential Broker to load a username and token variable from an Environment, then use them to log into Docker Hub.

```yaml config.yml theme={null}
on: push
name: Deploy app

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v3

      - name: Load Docker credentials
        id: load-docker-credentials
        uses: 1password/load-secrets-action@v5beta
        env:
          OP_WORKLOAD_ID: <your-workload-id>
          OP_ENVIRONMENT_ID: <your-environment-id>
          OP_INTEGRATION_KEY: ${{ secrets.OP_INTEGRATION_KEY }}

      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_USERNAME }}
          password: ${{ steps.load-docker-credentials.outputs.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          push: true
          tags: acme/app:latest
```

## Get help

If you don't see GitHub Actions as a destination in the 1Password desktop app, make sure your administrator has [connected your GitHub organization to your 1Password account](#requirements).

If you see an OIDC-related error in your workflow log in GitHub, make sure you have `id-token: write` set in the `permissions` [within your workflow. <Icon icon="arrow-up-right-from-square" />](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions). This permission allows GitHub to generate a short-lived token that 1Password uses to identify your workflow before suppling your secrets at runtime.

## Learn more

* [1Password Environments (beta)](/environments)
* [Load secrets from 1Password into GitHub Actions](/ci-cd/github-actions)


## Related topics

- [Load secrets from 1Password into GitHub Actions](/ci-cd/github-actions.md)
- [Secure CI/CD and deployments with 1Password](/get-started/secure-deployment.md)
- [Secret reference syntax](/cli/secret-reference-syntax.md)