Access GitHub Secret Key

user_13801110 0
Viewed 2386

I'm lost as to how to handle secret keys.

I've published a repo on GitHub with a secret key (I know now, big no no), then found out about the GitHub Secret Key in the settings and stored the key there.

So, two questions:

  • what's the best way to clean the commit history so that the secret key isn't available anymore?
  • how do I actually access this secret key? In my settings.py, I now had SECRET_KEY = 'name_of_key_on_github' but that throws NameError: not defined.

Any help is appreciated, thank you.

Update

Ok, so according to the link provided by @VonC, I need to create a .yml file in .github/workflows directory.

general.yml

name: key #needed but name can be arbitrary

on: [push, pull_request, deployment]

env:
    runs-on: ubuntu-latest
      - uses: actions/labeler@v2
        with:
          repo-token: ${{ secrets.name_of_my_key }}
      credentials: #these don't work yet, if anyone can tell me why?
        username: ${{ github.actor }}
        password: ${{ secrets.ghcr_token }}

settings.py

SECRET_KEY = "../.github/general.yml"

Project structure if you want / need to reproduce:

myrepo
├── app_name
│   ├── settings.py
├── .github
│   ├── workflows
│   │   ├── general.yml

I can run python manage.py runserver, but on pushing to remote I get the following error:

! [remote rejected] master -> master (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/general.yml` without `workflow` scope)

Update 2

Hadn't enabled the workflow scope (github.com > profile > settings > developer settings > personal access tokens):

You need to make sure box is checked.

workflow box needs to be checked

secret-key github
1 Answers

Use the new git filter-repo, which does replace the old git filter-branch or BFG.

It has many usage examples, including content-based filtering, in order for you to remote the path/to/secret file in past commits:

To keep all files except these paths, just add --invert-paths:

git filter-repo --path path/to/secret --invert-paths

You can add --dry-run to test it before actually changing your repository.

Then git push --force (that does rewrite the history of your repository, so make sure to notify any other collaborator)

Since it must be done on a fresh clone:

  1. Don't touch anything to your current clone folder
  2. Create a separate clone of the repository, where you do the filter repo
  3. In that second clone, now cleaned (no more big file in its history), import your work from your first repo

That is, for point 3:

cd /path/to/second/clone
git --work-tree=/path/to/first/original/clone add .
git commit -m "Import work from first clone"
git push --force

Regarding git gilter-repo, see a complete example in "Removing sensitive files from git from Boopathi Rajaa.

You can store encrypted keys, but available for GitHub Actions only.

Outside of GitHub Actions, see Github, secret keys and other local settings from Paul Smits.

For that you need a credential (PAT) with workflow scope.

VonC_63090
Related