Secrets and Variables

You can store CI secrets and variables in Quant and read them in a workflow with the same syntax you use for GitHub’s own:

    steps:
      - run: ./deploy.sh
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
          REGION: ${{ vars.REGION }}

Quant gives the values to a job when the job starts on one of your pools. Jobs on GitHub-hosted runners do not receive them.

Kinds of value

Kind	Shown in the dashboard	In job logs	Read in a workflow as
Secret	Never, after you save it	Masked as ***	${{ secrets.NAME }}
Variable	Yes	Not masked	${{ vars.NAME }}

A value can have more than one line, so a PEM key or a certificate can be stored as it is.

Add a value

1. Open Cloud → CI runners and choose the Secrets and variables tab.
2. Choose Add value.
3. Choose Secret or Variable.
4. Choose where it applies: Whole organisation, or One repository. For one repository, enter it as owner/name.
5. Enter the name and the value.
6. Optionally enter branches, separated by commas, for example main, release/*. Leave the field empty to allow all branches.
7. Choose Save.

Jobs that start after you save receive the value. To change a secret, choose Replace value. Quant does not show a saved secret again.

Scopes

A value for the whole organisation reaches every job of your GitHub organisation that runs on your pools. A value for one repository reaches only the jobs of that repository.

When the same name exists at both scopes, the repository value is used for that repository.

Limit a value to branches

A branch list keeps a value away from jobs that run for other branches. Use it for deploy credentials that only a release branch should receive.

A value with a branch list reaches a job only when the job runs for a push, a manual run, a scheduled run or a release on one of the listed branches. An entry is an exact branch name, or a prefix that ends in *, such as release/*. Jobs for pull requests and other events do not receive it.

Pull requests from forks

A job that runs for a pull request from a fork receives no Quant values at all. This also applies to pull_request_target and workflow_run jobs that a fork started, which is stricter than GitHub.

Quant values and GitHub values with the same name

When a Quant value and a GitHub secret or variable have the same name, a job on a Quant runner gets the Quant value. This lets you move one secret at a time: add it in Quant, check a run, then delete it on GitHub.

Names that exist only on GitHub still work on Quant runners.

What Quant does to protect a secret

• A secret is encrypted when you save it, and the dashboard cannot read it back.
• A job receives only the values of its own organisation, its own repository and its own branch.
• A value is given to the runner in memory when the job starts. It is not written to the machine’s disk.
• A step sees a secret only when the workflow passes it to that step, as with GitHub’s own secrets.
• If Quant cannot deliver the values, the job fails before its first step, so a job never runs without its secrets.

As on GitHub, masking matches the exact value. A secret that a step transforms, for example with base64, is not masked in the log.

Delete a value

Choose Delete on the value. Jobs that start after that no longer receive it. You cannot undo a delete.