An organization secret named DEPLOY_KEY is configured for selected repositories, but a newly onboarded repository receives an empty value. The secret name is spelled correctly. What should an administrator check first?

1. Verify the new repository is included in the organization secret selected repositories and adjust that secret access policy if needed.
2. Move the job to a self-hosted runner because those runners automatically receive all organization secrets.
3. Grant the repository token more write scopes so it can bypass the organization secret repository selection.
4. Whether the workflow sets the same value as a plaintext repository variable.