managing-github-actions-secrets

Managing GitHub Actions secrets for PostHog

PostHog centralizes all GitHub Actions secrets at the organization level and grants individual repositories access to them. Do not add secrets to a single repo, even if the secret is only consumed by one workflow today.

The rule

• Always create secrets on the posthog org, not on a repo.
• Grant the secret to specific repos via the org-level access control (selected repositories). Do not make it available to all repos by default unless the secret is genuinely meant to be shared org-wide.
• Never paste secret values into chat, PR descriptions, commit messages, or files. Pipe them in, or paste them only into the GitHub UI's secret field.

Creating or updating a secret via gh CLI

Pipe the secret value into gh secret set with --org posthog. The example below reads the value from stdin so it never appears in shell history:

# Read from clipboard / a pipe / a file — never inline as an argument
pbpaste | gh secret set POSTHOGOS_PACKAGER_KEY --org posthog

Common variants:

# From a file
gh secret set POSTHOGOS_PACKAGER_KEY --org posthog < secret.txt

# Restrict to selected repositories at creation time
gh secret set POSTHOGOS_PACKAGER_KEY --org posthog \
  --visibility selected --repos PostHog/posthog,PostHog/posthog-foss

# Update which repos can access an existing org secret
gh secret set POSTHOGOS_PACKAGER_KEY --org posthog \
  --visibility selected --repos PostHog/posthog

Verify:

gh secret list --org posthog | grep POSTHOGOS_PACKAGER_KEY

Creating or updating a secret via the GitHub UI

1. Open https://github.com/organizations/PostHog/settings/secrets/actions.
2. Click New organization secret (or the existing secret to update it).
3. Set the Name (SCREAMING_SNAKE_CASE, descriptive, like POSTHOGOS_PACKAGER_KEY).
4. Paste the Value.
5. Under Repository access, choose Selected repositories and pick the exact repos that need it. Avoid All repositories unless the secret is safe to expose to every repo in the org.
6. Click Add secret / Update secret.