Skip to content

SECRETS.adoc

Latest commit

 

History

History
84 lines (54 loc) · 2.47 KB

SECRETS.adoc

File metadata and controls

84 lines (54 loc) · 2.47 KB

Secrets Management

This document outlines the secrets management practices for this repository.

Types of Secrets

We use the following types of secrets in this project:

  1. Repository Secrets: Stored at the repository level

  2. Environment Secrets: Specific to deployment environments

  3. Organization Secrets: Shared across multiple repositories

Secrets Storage

All secrets are stored securely using GitHub’s built-in secrets management system. They are encrypted at rest and in transit.

Accessing Secrets

Secrets can be accessed in GitHub Actions workflows using the following syntax:

${{ secrets.SECRET_NAME }}

Current Secrets

Repository related secrets

Table 1. Github Secrets
Secret Name Description Type Used In
Table 2. Github Workflows
Workflow Name File Name Description

Build

build.yml

Continous Integration workflow running build and tests

Adding New Secrets

To add a new secret:

  1. Navigate to the repository settings

  2. Click on "Secrets and variables" under the "Security" section

  3. Select "Actions" (for workflow secrets)

  4. Click "New repository secret"

  5. Provide a name and value for the secret

Secret Naming Convention

  • Use UPPER_SNAKE_CASE for secret names

Secret Rotation

No generic instructions available.

Best Practices

  1. Least Privilege: Only grant access to secrets on a need-to-know basis.

  2. Regular Rotation: Rotate secrets periodically to minimize the impact of potential breaches.

  3. Avoid Hardcoding: Never hardcode secrets in the codebase or commit them to version control.

  4. Audit Usage: Regularly review where and how secrets are being used in workflows.

  5. Use Environment Secrets: For sensitive production credentials, use environment secrets with required reviewers.

Security Considerations

  • Do not log or display secrets in workflow outputs

  • Be cautious when using secrets in pull request workflows from forked repositories

  • Consider using OIDC with cloud providers for enhanced security

Additional Resources

Note
 Remember to keep this file updated as your secrets management practices evolve. Do not include any actual secret values in this file