To build a .NET application while securely handling a sensitive enterprise license on a GitHub- hosted Ubuntu runner, you should store the Base64-encoded license as a GitHub Repository Secret.
Key Security Considerations
Ephemeral Runners: GitHub-hosted runners are wiped after every job, meaning the decoded license file is automatically deleted.
Log Redaction: GitHub attempts to redact any output that matches your secret value, but manual transformations (like decoding) should still be handled carefully.
No Artifacts: Avoid using upload-artifact for any directories containing the decoded license, as artifacts can be downloaded by anyone with repository access
1. Store the License as a Secret
First, encode your license file to Base64 locally to ensure it is stored as a single string without formatting issues:
# On your local machine (Linux/macOS)
cat license.lic | base64 -w 0 > license_base64.txt
Then, add this string to your repository by navigating to Settings > Secrets and variables > Actions > New repository secret. Name it ENTERPRISE_LICENSE_BASE64.
2. Configure the GitHub Actions Workflow
Create a .yml file in .github/workflows/ that decodes the secret into a temporary file on the Ubuntu runner. GitHub automatically masks the secret value in logs, ensuring it remains private.
name: Build .NET App with License
on:
push:
branches: [ "main" ]
jobs:
build:
runs-on: ubuntu-latest # Use GitHub-hosted Ubuntu runner
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
dotnet-version: '8.0.x' # Specify your version
- name: Decode License
shell: bash
run: |
# Decode the secret into a file for the build process
echo "${{ secrets.ENTERPRISE_LICENSE_BASE64 }}" | base64 --
decode > ./license.lic
# The runner is ephemeral; the file is destroyed when the job ends.
- name: Restore dependencies
run: dotnet restore
- name: Build Application
# Pass the license path if your build process requires it
run: dotnet build --configuration Release --no-restore /p:LicensePath=./license.lic
- name: Secure Cleanup (Optional)
if: always()
run: rm -f ./license.lic
Reference:
https://docs.github.com/actions/security-guides/using-secrets-in-github-actions

GITHUB_REF : The branch or tag ref that triggered the workflow.
Reference:
https://graphite.dev/guides/github-actions-variables

Scheduled workflows run on the latest commit on the default branch.
Note: The default branch is also the initial branch that Git checks out locally when someone clones the repository. Unless you specify a different branch, the default branch in a repository is the base branch for new pull requests and code commits.
Reference:
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
https://docs.github.com/articles/about-branches

Input parameters for the cache action
[C] key: Required The key created when saving a cache and the key used to search for a cache.
It can be any combination of variables, context values, static strings, and functions. Keys have a maximum length of 512 characters, and keys longer than the maximum length will cause the action to fail.
[A] path: Required The path(s) on the runner to cache or restore.
Reference:
https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching

The correct option is Set env in the workflow YAML because defining environment variables at the top level of a workflow makes them available to every job and step in that single run.
In a workflow file you can declare a top level mapping for environment variables with key value pairs. This top level scope propagates the values to all jobs and steps in the run and you can override them at job or step scope when necessary. This is the most direct way to share non secret configuration across the entire workflow execution.