GitHub Actions secret referenced in a matrix name shows as a masked value

By Daniel Zoghalchali·Latchkey

GitHub masks any secret value wherever it appears in logs and the UI, including job and matrix leg names. Referencing a secret (directly or via an env var derived from one) in a name produces *** instead of a readable label.

What this error means

Matrix leg names in the run UI render as *** rather than the intended descriptive label.

strategy:
  matrix:
    region: [${{ secrets.PRIMARY_REGION }}]   # secret value masked in the name
# UI shows: build (***)

Common causes

Secret value used in a display name

Masking applies everywhere the literal secret string would otherwise appear, including matrix names.

Env derived from a secret reused as a label

An env var assigned from a secret still triggers masking when printed as a name.

How to fix it

Use non-secret labels for naming

1. Drive matrix names from non-sensitive identifiers, not secret values.
2. Map the label to the secret inside the step rather than in the name.

strategy:
  matrix:
    region: [primary, secondary]
env:
  REGION_VALUE: ${{ matrix.region == 'primary' && secrets.PRIMARY_REGION || secrets.SECONDARY_REGION }}

Keep secrets out of names and config keys

1. Never place a secret where it is rendered as a name, title, or run-name.
2. Resolve the secret only inside run/with where masking in logs is acceptable.

How to prevent it

• Treat all names and run-name fields as public; never embed secrets there.
• Select secrets indirectly from a non-secret matrix key.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions