Github Secret

GithubSecret

Defines an organization-level secret for use in GitHub Actions.

Provisions a GitHub Actions organization secret whose value is either supplied inline or resolved from an upstream Secret manifest, making credentials (API tokens, registry passwords) available to CI/CD workflows across repositories without exposing them in plaintext.

Property	Type	Description
apiVersion	string	API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1.
kind	string	Resource kind discriminator. Identifies this document as a GithubSecret so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant GithubSecret.
metadata	map	Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent in the dependency graph. The organization label is also folded into the computed normalized secret name.
spec	Spec	Desired secret definition. The authoritative, user-authored specification for this secret. See Spec.

Spec

User-provided secret definition.

Specifies the secret's payload as exactly one of an inline literal (value) or a reference to an organization Secret manifest (value_ref). Validation rejects setting both or neither.

Property	Type	Description
description	string	Human-readable description of this secret. Optional free text describing what the secret is for. Not propagated onto the provisioned GitHub Actions secret; it exists purely as documentation and as context for AI assistants reasoning about the organization's structure.
value	string	Inline plaintext secret value. Literal value used to create the GitHub Actions organization secret. Intended only for non-sensitive values; for sensitive data use value_ref instead. Mutually exclusive with value_ref (exactly one must be set).
valueRef	string	Reference to an upstream organization Secret manifest. Name of an organization-level Secret manifest whose payload is resolved at execution time and used to create the GitHub Actions organization secret. The engine links the two manifests automatically. Mutually exclusive with value (exactly one must be set); validation also requires a matching organization Secret to exist.