how to use github secrets in code

How can I use Github secrets in JS files

stackoverflow.com › questions › 59686823 › how-can-i-use-github-secrets-in-js-files

You can pass-in Secrets as ENV variables.

Example:

   ...
   steps:
      - name: Git checkout
        uses: actions/checkout@v2

      - name: Use Node 12.x
        uses: actions/setup-node@v1
        with:
          node-version: 12.x

      - name: Install Dependencies (prod)
        run: yarn install --frozen-lockfile --production

      - name: Run Tests (JEST)
        run: yarn test --ci --silent --testPathIgnorePatterns=experimental
        env:
          CI: true
          API_KEY: ${{ secrets.API_KEY }}

In Node.js you can access it via process.env.API_KEY.

Answer from scthi on Stack Overflow

DEV Community

dev.to › pwd9000 › best-practices-for-using-github-secrets-part-1-596f

Best Practices for Using GitHub Secrets - Part 1 - DEV Community

July 18, 2024 - Navigate to Your Repository: 1.1. Go to your GitHub repository. 1.2. Click on Settings. Access Secrets: 2.1. In the left sidebar, click on Secrets and variables under the Security section. 2.2. Notice that you have options for Actions, Codespaces and Dependabot.

Stack Overflow

stackoverflow.com › questions › 59686823 › how-can-i-use-github-secrets-in-js-files

How can I use Github secrets in JS files

Top answer

1 of 3

41

You can pass-in Secrets as ENV variables.

Example:

   ...
   steps:
      - name: Git checkout
        uses: actions/checkout@v2

      - name: Use Node 12.x
        uses: actions/setup-node@v1
        with:
          node-version: 12.x

      - name: Install Dependencies (prod)
        run: yarn install --frozen-lockfile --production

      - name: Run Tests (JEST)
        run: yarn test --ci --silent --testPathIgnorePatterns=experimental
        env:
          CI: true
          API_KEY: ${{ secrets.API_KEY }}

In Node.js you can access it via process.env.API_KEY.

2 of 3

2

I Find a way to achieve it although it might not be the best (And I'm definitly not bash expert)

So create a setEnv.sh file

mkdir env
echo "export const environment = { firebase_api_key : '$1' }"  > env/env.ts

That take as your API key as first parameter, create a env folder and save TS code with your api key.

Then add this line

- run: sh setEnvironment.sh ${{ secrets.FIREBASE_API_KEY }}

Into your github action script, which will execute your script and set the Secret Key.

You'll now just have to use environment.firebase_api_key in your code.

Note: Your build needs to encrypt your key otherwise it will be exposed. But this can be usefull for example if you use API keys on your website and you also want your website code to be available in public on Github, without those plain keys.

Discussions

How do I get my local code to use a github secret after I make/run the action for it?

You don’t use an actions secret locally, it’s used by the actions machine. It looks like you want to set an environment variable so you’ll need to use some other local option to store the secret such as a .env file (that you don’t commit, be sure to add it to your .gitignore)or by adding it to your environment variables directly in the shell. More on reddit.com

r/github

3

1

February 9, 2023

Using GitHub Secrets without using GitHub Actions

I was wondering if it’s at all possible to use GitHub secrets in python code located in the repository without initializing the secrets in the env section of the GitHub Actions yaml file. I have no... More on github.com

github.com

6

2

Is storing credentials in Github Secrets considered safe?

I'm guessing this would mean your RDS is on a public subnet / open to the internet which is not a good idea in general. But besides that I would suggest in this case to use: Authenticate with OIDC github -> AWS for temporary shortlived credentails. Use RDS IAM authentication for the migration, that way you also there get shortlived temporary credentials for the database. (not saying you should use RDS IAM auth for your app, but for the migration in the scenario you paint is ok). It's not per say that github secrets in considered insecure. But using static AKSK and password when not needed is less secure. More on reddit.com

r/devops

19

30

April 5, 2025

It is safe to use secret in Action in a public repo?

Secrets are reasonably safe as long as you're not outputting values anywhere (logs or otherwise) and are using GitHub hosted runners (which are ephemeral). The bigger risk IMO would be someone opening a PR with a modified workflow that exports your secrets. Take care that your workflows don't trigger on pull_request_target and that you don't allow actions to run by default on PRs from first time contributors. Review all pull requests for changes to workflow files. Maybe even setup CODEOWNERS for workflow files as an extra approval step. Also, deployment environments can help to section off secrets too. You can make jobs on a certain environment require approval before the workflow can run - allowing you to proactively review before the job is permitted to execute and therefore read the environment secrets. Going beyond, lookup the "hardening for actions" GitHub official document for more info on secrets and best practices. Also, check google "preventing pwn requests on GitHub" from GitHub's security lab team. More on reddit.com

r/github

12

2

February 7, 2024

Videos

07:05

YouTube

GitHub Actions SECRETS • #secrets #devops #githubactions - YouTube

June 1, 2023

15K