Do I need to pass each secret to my GitHub Actions workflow file?

user_5744804 0
Viewed 247

I have a number of secrets, stored in Settings/Secrets/Action of my repo.

image of github settings page with action secrets

The various secrets are used by my application but none of them are used in the command.

name: BuildCheck

on:
  push:
  pull_request:
    branches: [main]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 14
      - run: npm ci
      - run: npm run build

Do I need to add all the variables under env top level map in the config file above in order for the action to use them?

This seems to break my automated flow of managing secrets with Doppler.

Is there a way to inject all secrets, without explicitly specifying them? (I did look at the docs but failed to find if this is possible)

Coming from Vercel, which does this it feels like a bit of a step back.

github-actions
1 Answers

There's a bit to unpack here.

Do I need to add all the variables?

The short answer: yes.

However what's good to consider is that secrets often only configure connections between system in the form of secret keys or application access using a license or credentials.

It is not common to add other configuration options inside the secrets.

Under env: top level map in the workflow file?

I would discourage putting secrets in the top level env.

Reason is that env will be exposed to all subsequent jobs. In case someone adds a job that's not trusted with this information (say an external action) it could become a problem.

So what's good practice?

Firstly: Split configuration from secrets:

  • Using configuration files for configuration options.
  • Using secrets for secret keys or other credentials.

Secondly: Using security first.

  • Configure each workflow step with just the information it needs
  • Explicitly pass secret variables to action parameters

Lastly: store configuration as close to the app as possible, optionally having multiple - each for a different environment.

Comparison with Vercel

Vercel abstracts away the workflow entirely and as a result can only do very specific things. The nature of each system is different and gives you different levels of flexibility.

user_35938960
Related