An auditor asks an engineer to retrieve, in plaintext, the current value of an existing non-sensitive configuration variable named BUILD_REGION through the GitHub REST API. Which statement correctly describes what the relevant Actions REST API can return for this request?
- AThe get-a-secret endpoint returns the decrypted value of any registered item, so calling it for BUILD_REGION yields the plaintext that the auditor needs.
- BThe list-variables endpoint returns only an encrypted_value field per variable, so the auditor must decrypt the value with the repository public key after the call.
- CThe get-a-repository-variable endpoint returns the variable's name and its current value as plaintext, because configuration variables are stored unencrypted and are readable through the variables REST API. Correct
- DNo Actions REST endpoint can return a stored variable value, so the engineer must add a workflow step that echoes vars.BUILD_REGION and then read it from the run log.
Why A is wrong: This is tempting because secrets and variables share similar endpoints, but the get-a-secret response only returns metadata such as the name and timestamps, never the decrypted value, and BUILD_REGION is a variable, not a secret.
Why B is wrong: This is tempting because secrets are sealed against the public key, but variables are never encrypted. The variables endpoints return plaintext values and there is no encrypted_value field to decrypt.
Why C is correct: Configuration variables are stored unencrypted, so the get-a-repository-variable endpoint returns both the name and the current value in plaintext, which directly satisfies the auditor's request.
Why D is wrong: This is tempting because a workflow can echo a variable, but it is unnecessary. The variables REST API exposes the value directly, so reading it from a log is not required.