Is there any way to fetch github secret value and display in workflow or fetch through library or APi or even github portal once it is stored.
I just want to validate.
Github Actions replaces secret values in the log, so if you want to view the secret you must change its value first. Like this step:
- name: DISPLAY SECRETS
run: echo ${{secrets.mysecret}} | sed 's/./& /g'
This will insert a space between each character of the secret, allowing you to see its value.
There is no way to actually display the github secret value but there are ways to validate eg you can use if: {{secret_name}} == 'release' , then do this else do that.
Reference for writing if condition in github workflow: https://github.blog/changelog/2019-10-01-github-actions-new-workflow-syntax-features/
Related
Prequisite: I have read: https://docs.aws.amazon.com/codebuild/latest/userguide/sample-github-pull-request.html
I also read this: https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html
and this: Accessing GitHub pull request details within AWS CodeBuild
We have several codebuild jobs that trigger on Github pull requests/pull request updates.
As that other question states, far I have seen $CODEBUILD_WEBHOOK_EVENT which shows something like PULL_REQUEST_UPDATED and CODEBUILD_WEBHOOK_TRIGGER which shows something like pr/123
However I am trying to get the actual payload of the webhook event - specifically the title and description of the PR. How can I obtain these?
My fear is that the answer is this information is lost, and that somehow I need to connect to the github API from within the codebuild job in a back and forth. But then they question will be how to authenticate since this is a private repo..
Not sure if you ever found an answer to this, but I ran into something similar. To get other info from GitHub, I used its API. For authentication, you can add the GitHub token as an environment variable in the buildspec file. I'd recommend storing it in Parameter Store as a secure string. Here's a working example file that retrieves the name of the first label on the PR:
version: 0.2
env:
shell: bash
parameter-store:
GITHUB_AUTH_TOKEN: GITHUB_AUTH_TOKEN
phases:
install:
runtime-versions:
nodejs: 16
build:
commands:
- |
PR_NUMBER=$(cut -d "/" -f2 <<< "$CODEBUILD_SOURCE_VERSION")
echo $PR_NUMBER;
PR_LABEL_NAME=$(curl --request GET --url "https://api.github.com/repos/<put repo name here>/pulls/$PR_NUMBER" --header "Authorization:Bearer $GITHUB_AUTH_TOKEN" | jq -r '.labels[0].name');
If the build is triggered by a PR being created or updated, the CODEBUILD_SOURCE_VERSION var will have a value of "pr/1234" where "1234" is the pull request number. I'm using cut to get the number and drop "pr/".
Looking to confirm this is correct way to deal with the problem and if someone has a better idea.
I have the master branch set with protection, so you have PR into it and have signed commits.
I want to automate semver and current use:
- name: Automated Version Bump
id: version-bump
uses: 'phips28/gh-action-bump-version#master'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
skip-commit: 'true'
skip-tag: 'true'
The have it working at present by removing my protection to the branch.
Looks like the solution is to add Allow specified actors to bypass genereate a PAT and use that for the token instead of the GITHUB_TOKEN.
I cant get GITHUB_TOKEN to be excepted in the field manually,
So
first question: Is it possible to GITHUB_TOKEN to the bypass list (Maybe its a variable syntax or something!)
second question: if i need to switch, if this the good solution, to create a new account go though least priv etc?
I resolved this via:
creating a service account user that has read-write access to repo
create a pat for that service account
add the service account to the bypass protection rules in the branch
create a repo secret that contains the PAT token
update the line 'GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}' with the new secret
I am setting up Actions in Github, some of them require a Token for authentication. This is the process I follow to generate them, which is detailed in the Actions Docs:
Go to my Account, generate a PAT
Go to the project and add a Secret using that PAT value
Add the variable name in the Action yml file, for example:
env:
# used by semantic-release to authenticate at github and write to master
# I used the developer tab to generate the token and then paste it to several projs
# as a secret
GH_TOKEN: ${{secrets.GH_TOKEN}}
# used by semantic release to authenticate when publishing to npm
# Generate it in NPM (you just need to be registered at npm which is simple)
NPM_TOKEN: ${{secrets.NPM_TOKEN}}
Now, this is rather tedious, even having a single PAT, I'd still need to create a secret per project.
I have noticed though, that if you create an organization, you can create secrets at the ORG level.
Can you do something similar without having an organization? Can you create user secrets? Or maybe there is a way to use the user settings in the Project's Action?
To log in from GitHub to my external server I use/test appleboy/ssh-action. As soon as I am on the server I start a git pull to get the latest changes to the server. However, this also includes the .github/workflows folder. And in a GH action yml file is my SSH password. I would like to avoid this. But I don't know how. Somebody know how to do this?
You should not store the password in the YAML file itself. Instead, use the GitHub Actions secrets functionality in the repository settings to store the password as a secret, and then pass it in through the environment. For example, you can pipe a secret like so:
- run: echo $PASSWORD | my-program-here
env:
PASSWORD: ${{secrets.SSH_PASSWORD}}
You can see an example of how this kind of approach is use in the Git LFS release workflow.
The official boilerplate code injects the npm token as follows
NODE_AUTH_TOKEN: ${{secrets.npm_token}}
How do I access and set this variable? I cant find it in the GUI.
Go to your project in Github
Select the Settings tab
Click the Secrets section in the left hand menu
Add a new secret and provide a name (e.g. npm_token) and a value.
In addition to the GUI, you now (January 2020) have a GitHub Actions API(!, still beta though), as announced here.
And it does include a GitHub Actions Secrets API:
Create or update an repository secret:
Creates or updates an organization secret with an encrypted value. Encrypt your secret using LibSodium.
You must authenticate using an access token with the admin:repo scope to use this endpoint.
GitHub Apps must have the secrets organization permission to use this endpoint.
PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}
Get a repository secret
Gets a single secret without revealing its encrypted value.
Anyone with write access to the repository can use this endpoint.
GitHub Apps must have the secrets permission to use this endpoint.
GET /repos/:owner/:repo/actions/secrets/:name
So the GUI is no longer the sole option: you can script and get/set an Actions secret through this new API.
This page is hard to find, but it exists in the official docs here: Creating and using secrets (encrypted variables).
Copied from the docs below for convenience:
Secret names cannot include any spaces. To ensure that GitHub redacts
your secret in logs, avoid using structured data as the values of
secrets, like JSON or encoded Git blobs.
On GitHub, navigate to the main page of the repository.
Under your repository name, click Settings.
In the left sidebar, click Secrets.
Type a name for your secret in the "Name" input box.
Type the value for your secret.
Click Add secret.
The link above has a bit more info around using secrets as well.
I've created a simple CLI that can help you achieve that - https://github.com/unfor19/githubsecrets
This CLI is based on the official API. You can install it with pip or use Docker, read the README.md for more information