You can pass-in Secrets as ENV variables.

Example:

   ...
   steps:
      - name: Git checkout
        uses: actions/checkout@v2

      - name: Use Node 12.x
        uses: actions/setup-node@v1
        with:
          node-version: 12.x

      - name: Install Dependencies (prod)
        run: yarn install --frozen-lockfile --production

      - name: Run Tests (JEST)
        run: yarn test --ci --silent --testPathIgnorePatterns=experimental
        env:
          CI: true
          API_KEY: ${{ secrets.API_KEY }}

In Node.js you can access it via process.env.API_KEY.

Hi @maksiksking

Yes, Github Pages is a static hosting site as metioned in the thread you mentioned. You can host the node.js web app/api on another hosting platform that supports node.js (eg. heroku, render, etc.). And have the frontend that consumes the api hosted in github pages.

Secrets are mainly used for Github Actions. Github Actions are used for CI/CD pipelines -- in simple terms, it's used to automate stuff like testing, linting, build & deploy, etc. when an event in Github triggers.

Secrets allow you to store sensitive information such as tokens that limit the permissions of these workflows. These automated workflows may need additional permission to access/modify certain stuff for example, but you don't want them to have admin access that they can just delete your repo. See example workflow snippet:

# sample workflow snippet
steps: 
  - name: Build and deploy
    working-directory: ./app
    run: npm run deploy
    env:
      token: ${{ secrets.DEPLOY_TOKEN }}
       # deploy token is used to build and deploy to a gh-pages branch 
       # (needs permission to create a branch, build the app and modify that branch, 
       # push changes to that branch, and deploy to github pages)

You can read more at the Github official docs: Using secrets in Github Actions

ex: MongoClient(username: mongodb_pass) instead of having the password in plain sight in the script.

Not having the credentials directly in the script is good practice, yes. That has nothing to do with masking, though.

You can use environment variable just like in the Actions workflow, you’ll just have to set them when you run the script. Just be aware of what else you run in the same environment and of shell history (if you use Bash, HISTCONTROL is your friend).

An alternative is to use a config file, just read the values from another file instead of coding them into the script. Python has built-in parsers for JSON and INI-style files. I like YAML, but that requires installing PyYAML. Obviously don’t commit that file, I recommend adding it to .gitignore.

You can even support both in your script: Read environment variables or config file depending on command line options or simply what’s available.