Secrets

Tenki does not operate a secrets store. All secrets used in your workflows live in GitHub Actions secrets (repo, environment, or organization) and are injected into the job at runtime through the standard secrets.* mechanism.

This page explains why.

The model

• You store secrets in GitHub Actions (or in your own secret manager pulled in at job-time).
• Tenki provisions a fresh VM for the job.
• GitHub passes the secret values into the runner environment as usual.
• The VM, including any cached secret material, is destroyed when the job ends.

Because the VM is single-use (see Security & Isolation), there is no persistent state where secret material could leak between jobs.

Why we don't run our own secrets store

Two reasons:

1. Smaller blast radius. The fewer places your secrets live, the better. Re-using GitHub's secret store keeps the surface area to systems you already audit and trust.
2. No vendor lock-in. Your workflows remain identical to vanilla GitHub Actions. Migrating to or from Tenki does not require re-keying anything.

See Security & Isolation for the full model.

Using secrets in a workflow

Because Tenki uses GitHub Actions secrets natively, referencing them looks exactly like it does on GitHub-hosted runners; only the runs-on value changes:

jobs:
  deploy:
    runs-on: tenki-standard-small-2c-4g
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        env:
          API_TOKEN: ${{ secrets.API_TOKEN }}
        run: ./scripts/deploy.sh

GitHub injects secrets.API_TOKEN into the job at runtime and automatically masks the value in logs. When the job finishes, the VM (and any secret material it held in memory) is destroyed.

Bringing your own secret manager

If your secrets live in an external manager (such as HashiCorp Vault, AWS Secrets Manager, or GCP Secret Manager), nothing changes on Tenki. Authenticate to that provider inside the job, typically using a single GitHub Actions secret or OIDC, and pull the rest at runtime, exactly as you would on GitHub-hosted runners. The fetched values exist only for the lifetime of the ephemeral VM.

Frequently asked questions

Does Tenki store or log my secrets? No. Tenki does not operate a secrets store, and secret values are masked in logs by GitHub. They exist only in the ephemeral VM for the duration of the job.

Can secrets leak between jobs? No. Every job runs in a fresh, single-use Firecracker microVM that is destroyed when the job ends, so there's no persistent state shared between jobs.

Do I need to re-key my secrets when migrating to Tenki? No. Your workflows and secrets.* references stay identical; only the runs-on label changes.