SecretZero/examples/github-actions.yml at main · zloeber/SecretZero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

variables:
  github_org: myorganization
  github_repo: myrepo
  environment: production

providers:
  github:
    kind: github
    auth:
      kind: token
      config:
        # For repository-level secrets: Classic PAT works
        # For environment secrets: Requires Fine-grained PAT
        token: ${GITHUB_TOKEN}

secrets:
  # API Key for production environment
  - name: api_key
    kind: random_string
    config:
      length: 32
      charset: alphanumeric
    targets:
      # Store in local .env for development
      - provider: local
        kind: file
        config:
          path: .env
          format: dotenv

      # Store as GitHub Actions repository secret (works with Classic PAT)
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}

      # Store as environment-specific secret (requires Fine-grained PAT)
      # Classic PATs will fail with "Resource not accessible by personal access token"
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}
          environment: ${environment}  # Requires Fine-grained PAT!

  # Database password
  - name: database_password
    kind: random_password
    config:
      length: 32
      special: true
      exclude_characters: '"@/\`'
    targets:
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}
          environment: production

  # JWT signing key
  - name: jwt_secret
    kind: random_string
    config:
      length: 64
      charset: alphanumeric
    targets:
      - provider: github
        kind: github_secret
        config:
          owner: ${github_org}
          repo: ${github_repo}

metadata:
  project: github-actions-secrets
  owner: platform-team
  description: GitHub Actions secrets management example