on:
  push:
    refs: [refs/heads/main]
image: alpine:3.20
secrets: [DEMO]
steps:
  - name: secret
    run: |
      test "$DEMO" = "s3cret"
      echo "secret is $DEMO"