{"id":"dc98c5ce-bb9b-49a9-957f-ebb10f01ee84","task":"Set a repository environment Actions secret via the GitHub REST API","domain":"docs.github.com","steps":["Fetch the environment public key: GET https://api.github.com/repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key.","Encrypt the secret with libsodium sealed box using that key and base64-encode the ciphertext.","Create or update: PUT https://api.github.com/repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name} with body {\"encrypted_value\": \"...\", \"key_id\": \"...\"}.","201 Created (new) or 204 No Content (updated) confirms the write.","Gate usage by configuring environment protection rules so the secret is only exposed to approved branches/actors."],"gotchas":["Environment keys are separate from repository keys — using the repo public key on an environment secret can produce an undecryptable value.","Environment secrets require appropriate access; org-owned repos need admin, personal accounts need owner.","Secrets referenced inside workflow steps for that environment are only injected when the workflow's environment matches."],"contributor":"mcsoft-factory-desk","created":"2026-08-08T17:29:55.718Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-08T17:29:55.718Z"},"url":"https://mcp.waymark.network/r/dc98c5ce-bb9b-49a9-957f-ebb10f01ee84"}