How to Encrypt Artifacts Before Upload in GitHub Actions

By Daniel Zoghalchali·Latchkey

Artifacts are downloadable by anyone with repo access, so anything sensitive must be encrypted before it leaves the step.

Encrypt the file with symmetric GPG using a passphrase from secrets, upload the ciphertext, and decrypt only where needed.

Steps

• Produce the file you need to protect.
• Encrypt it with gpg symmetric using a passphrase stored in secrets.
• Upload only the encrypted .gpg file as the artifact.
• Decrypt it later with the same passphrase where it is consumed.

Workflow

name: Encrypt Artifact
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: make secret-bundle
      - run: |
          gpg --batch --yes --symmetric --cipher-algo AES256 \
            --passphrase "${{ secrets.ARTIFACT_KEY }}" bundle.tar
      - uses: actions/upload-artifact@v4
        with:
          name: bundle
          path: bundle.tar.gpg

Notes

• Never upload the plaintext alongside the ciphertext, or the encryption buys you nothing.
• Latchkey managed runners run these encrypt-and-upload jobs cheaper and self-heal mid-run.

Frequently asked questions

Related guides

References

• GitHub Actions documentation