feat(actions): show inherited org secrets/variables in repo settings #78

New Issue

2026-05-13T00:30:39Z

jmiller commented

2026-05-13 00:30:39 +00:00

Summary

Mimic GitHub behavior: when viewing repo-level Actions secrets and variables settings, also display inherited org-level secrets/variables so repo maintainers can see what is available and what they would override.

Current Behavior

Repo settings ? Actions ? Secrets only shows repo-level secrets. Users have no visibility into org-level secrets that are available to their workflows. Same issue with variables.

Expected Behavior (GitHub parity)

Repo secrets/variables page shows two sections:
1. Repository secrets � editable, same as today
2. Organization secrets � read-only list showing inherited org secrets, with:
  - Name (value is masked/hidden)
  - Description if set
  - "Inherited from organization" badge
  - Visual indicator if a repo-level secret overrides an org secret (e.g. strikethrough or "overridden" label)
Same pattern for variables
Org secrets cannot be edited from the repo page � link to org settings for management

Implementation Notes

GetSecretsOfTask() in models/secret/secret.go already handles the cascade correctly (org first, repo overrides)
Repo secrets handler in routers/web/repo/setting/secrets.go needs to also query FindSecretsOptions{OwnerID: repo.OwnerID} for display
Shared template repo/settings/actions needs an inherited secrets section
Same approach for variables in routers/web/shared/actions/variables.go

References

GitHub docs: Organization-level secrets are available to all repos in the org
Secret resolution: repo secrets take priority over org secrets with the same name

Authored-by: Moko Consulting

## Summary Mimic GitHub behavior: when viewing repo-level Actions secrets and variables settings, also display inherited org-level secrets/variables so repo maintainers can see what is available and what they would override. ## Current Behavior Repo settings ? Actions ? Secrets only shows repo-level secrets. Users have no visibility into org-level secrets that are available to their workflows. Same issue with variables. ## Expected Behavior (GitHub parity) - Repo secrets/variables page shows two sections: 1. **Repository secrets** � editable, same as today 2. **Organization secrets** � read-only list showing inherited org secrets, with: - Name (value is masked/hidden) - Description if set - "Inherited from organization" badge - Visual indicator if a repo-level secret overrides an org secret (e.g. strikethrough or "overridden" label) - Same pattern for variables - Org secrets cannot be edited from the repo page � link to org settings for management ## Implementation Notes - `GetSecretsOfTask()` in `models/secret/secret.go` already handles the cascade correctly (org first, repo overrides) - Repo secrets handler in `routers/web/repo/setting/secrets.go` needs to also query `FindSecretsOptions{OwnerID: repo.OwnerID}` for display - Shared template `repo/settings/actions` needs an inherited secrets section - Same approach for variables in `routers/web/shared/actions/variables.go` ## References - GitHub docs: Organization-level secrets are available to all repos in the org - Secret resolution: repo secrets take priority over org secrets with the same name --- *Authored-by: Moko Consulting*

jmiller referenced this issue from a commit

2026-05-13 01:06:23 +00:00

feat(actions): show inherited org secrets/variables in repo settings

jmiller referenced a pull request that will close this issue

2026-05-13 01:07:26 +00:00

feat(actions): show inherited org secrets/variables in repo settings #81

jmiller closed this issue

2026-05-13 01:17:20 +00:00

Sign in to join this conversation.