GitHub Actions secrets cannot be used in if conditions
The secrets context is not available in every key. Job-level if is evaluated before secrets are in scope, so a condition like if: secrets.TOKEN != '' fails to gate as intended.
What this error means
A job or step that should run only when a secret is present runs (or skips) unexpectedly, or the workflow errors that secrets is not a recognized context in that location.
github-actions
Unrecognized named-value: 'secrets'. Located at position 1 within expression: secrets.DEPLOY_KEY != ''Common causes
Job-level if cannot read secrets
The secrets context is not available in jobs.<id>.if; the condition errors or never matches.
Gating presence of a secret directly
Conditionals that branch on a secret value leak intent and are not supported at job scope.
How to fix it
Promote the secret to an env or output first
- Set a job-level env var from the secret, then branch on the env in a step.
- Or compute a boolean output in an early step and gate later steps on that output.
- Avoid referencing secrets.* inside jobs.<id>.if.
.github/workflows/deploy.yml
jobs:
deploy:
runs-on: ubuntu-latest
env:
HAS_KEY: ${{ secrets.DEPLOY_KEY != '' }}
steps:
- if: env.HAS_KEY == 'true'
run: ./deploy.shHow to prevent it
- Never reference secrets.* in job-level if.
- Convert secret presence to an env var or step output, then branch on that.
Frequently asked questions
What causes "secrets in if conditions"?
The secrets context is not available in jobs.<id>.if; the condition errors or never matches.
How do I fix secrets in if conditions?
Promote the secret to an env or output first
Related guides
GitHub Actions env context not available in jobs.<id>.ifFix GitHub Actions where the env context is empty in job-level if - env is not available in jobs.<id>.if and…
GitHub Actions if condition always runs (string vs expression)Fix a GitHub Actions if condition that always runs - a bare string in if is truthy, so the step never skips.
GitHub Actions reusable workflow secret not inheritedFix a GitHub Actions reusable workflow whose secrets are empty - secrets must be passed explicitly or with se…