Comment by kageneko

They don't have direct access. You need to assign the secret in your workflow file.

Example:

  steps:
    - uses: actions/checkout@v2
    - uses: sfdx-actions/setup-sfdx@v1
      with:
        sfdx-auth-url: ${{ secrets.SFDX_AUTH_URL }}

or

  steps:
    - uses: actions/checkout@v2
    - name: Run deployment script
      env:
        HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }}

The first is for an Action, the second is for a normal workflow script.