With new workflow syntax features (https://github.blog/changelog/2019-10-01-github-actions-new-workflow-syntax-features/) it is possible to define environment variables per workflow, per job or per step. However, there is no mechanism to set some environment variables for some steps only. In some contexts, it is desirable to make some secrets available to the last step in each job, but not to all other intermediate steps. See, for example, the usage of DOCKER_USER and DOCKER_PASS in https://github.com/dbhi/docker/blob/master/.github/workflows/push.yml.

Supporting YAML anchors would allow to define the envvars once only:

  - env: &docker_cred
      DOCKER_USER: ${{ secrets.DOCKER_USER }}
      DOCKER_PASS: ${{ secrets.DOCKER_PASS }}

and

  - env:
      <<: *docker_cred