Is there a way to access GitHub secrets in a local env file? So instead of having a secret saved directly in the env file it would reference a GitHub secret. I've seen that the GitHub secrets can be used within a workflow but I mainly just need to have the values in the env file.
I think you might be confusing things.
A local env file does not access variables, instead, your code reads the env file and uses those variables.
If you use something like dotenv, this tool will read your env files, and optionally override them if you defined the variables directly on the environment.
You can use an action workflow (disclosure: i'm the author) that exports your github secrets as env variables, so last part (overrides) would just work.
An example would be:
- run: echo "Value of MY_SECRET1: $MY_SECRET1"
env:
MY_SECRET1: ${{ secrets.MY_SECRET1 }}
MY_SECRET2: ${{ secrets.MY_SECRET2 }}
MY_SECRET3: ${{ secrets.MY_SECRET3 }}
MY_SECRET4: ${{ secrets.MY_SECRET4 }}
MY_SECRET5: ${{ secrets.MY_SECRET5 }}
MY_SECRET6: ${{ secrets.MY_SECRET6 }}
...
You could convert it to:
- uses: oNaiPs/secrets-to-env-action#v1
with:
secrets: ${{ toJSON(secrets) }}
- run: echo "Value of MY_SECRET1: $MY_SECRET1"
Link to the action, which contains more documentation about configuration: https://github.com/oNaiPs/secrets-to-env-action
See this related SO post.
Related
With GitHub Actions I'm trying to set up a service that runs a specific image (MySQL preloaded with a database) that I have pushed to ghcr.io however when it runs I get this error:
Error response from daemon: denied
Warning: Docker pull failed with exit code 1, back off 8.976 seconds before retry.
Workflow:
services:
mysql:
image: ghcr.io/my-name/my-image
ports:
- 3306:3306
I see it does the following:
/usr/bin/docker --config /home/runner/work/_temp/.docker_[...] login ghcr.io -u myusername --password-stdin
There is no feedback so not sure if it is logged in or not. And, then:
/usr/bin/docker --config /home/runner/work/_temp/.docker[...] pull ghcr.io/my-name/my-image
And then I get that error.
I have found many examples (see below) to use GITHUB_TOKEN but not how to use it within the services section so I am not sure if this works or what the syntax would be. So is it even possible to use with services or not? Also have given the repository in which the GitHub action is defined access to the specific package.
steps:
- name: Checkout repository
uses: actions/checkout#v3
- name: Log in to the Container registry
uses: docker/login-action#f054a8b539a109f9f41c372932f1ae047eff08c9
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
So I finally found the issue, in my workflow (started from default template) I had:
permissions:
contents: read
Then I saw this:
Setting permissions in the workflow
A new permissions key supported at the workflow and job level enables
you to specify which permissions you want for the token. Any
permission that is absent from the list will be set to none.
This caused packages to be set to none. Removing the whole permissions or adding:
packages: read
fixes this issue I had, thanks for the help.
When I push a commit with a tag, a docker container is automatically built by the docker/build-push-action#v1 GitHub Actions. The tag indicates the version number, which I want to show in the application.
Here is my workflow:
- name: Push to Docker Hub - develop
uses: docker/build-push-action#v1
with:
repository: my_repo/my_image
path: frontend/
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
tags: develop
args: SOFTWARE_VERSION=${{ steps.vars.outputs.tag }}
At that moment the variable SOFTWARE_VERSION should be available in the Dockerfile, is that right?
In my Dockerfile I set:
ARG SOFTWARE_VERSION
ENV SOFTWARE_VERSION ${SOFTWARE_VERSION}
Inside the container, the variable has an empty value. How to do it properly?
I don't know if it matters, but I run the container using docker-compose.
You are using args to pass the arguments.
However, the #v1 of https://github.com/docker/build-push-action offers build_args and #v3 build-args.
You should choose accordingly for the version that you need to use. IMO, you should go for the latest one.
Go to your Settings->Secrets and Variables
Add two Secrets
DOCKERHUB_USERNAME your username on Dockerhub
DOCKERHUB_TOKEN this is the token,you can get it from DockerHub
You must add this to precede Build and Push
— name: Login to DockerHub
if: GitHub.event_name != 'pull_request'
uses: docker/login-action#v1
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
I have a script that deploy my application in DockerHub and I want to start to create versions for it by using the Actions of GitHub. But for it I need to edit some environment variable like this:
env:
version : ${{ secrets.VERSION }}
- name: Build Docker Image
run: docker build -t $REPO:version -t $REPO:${GITHUB_SHA::8} .
run: version++
${{ secrets.VERSION }} = version
How can I edit a variable and store it in GitHub Secrets?
I'm getting started with CI/CD and Docker and i wanted to pass a connection string to docker in my workflow file.
deploy:
runs-on: ubuntu-latest
needs: publish
steps:
- name: deploy to server
uses: appleboy/ssh-action#master
env:
CONN_STRING: ${{ secrets.CONN_STRING }}
with:
host: ${{ secrets.SECRET_IP }}
username: ${{ secrets.SERVER_USERNAME }}
key: ${{ secrets.SERVER_KEY }}
port: 22
script: docker stop *** && docker rm **** && docker pull **** && docker run --env CONN_STRING=$CONN_STRING -d --name ******
As you can see i made an env called "CONN_STRING" which gets the connection string out of my github secrets. After that i want to pass it into the dockerscript by "CONN_STRING=$CONN_STRING". However my docker keeps crashing since I've added this. Anyone knows what I'm doing wrong?
The **** are merely names of my project, which i'd like to keep private.
You can add arg after FROM step:
ARG CONN_STRING
ENV connection_string=$CONN_STRING
and then pass it to a docker build command '--build-arg CONN_STRING=$CONN_STRING'
and then later in dcoker file you can refer to connection string as this ${connection_string}
Turns out you can just skip the environment variable in yml and use
CONN_STRING=${{ secrets.CONN_STRING }}
Consider we Have 10 Docker files but i made some changes only in 1 Docker file.so In Github action we generally build all 10 docker files instead of 1 docker file.
So Is there any way to write conditions such that github actions should build that particular dockerfile which we made changes.
You can try to use this github action:
https://github.com/trilom/file-changes-action
Go over the docs to see how to use it. But basically an example would be similar to this:
- name: Get file changes
id: get_file_changes
uses: trilom/file-changes-action#v1.2.3
with:
githubToken: ${{ secrets.GITHUB_TOKEN }}
plaintext: true
- name: Echo file changes
run: |
echo Changed files: ${{ steps.get_file_changes.outputs.files }}
- name: do something on the changed files ussing ${{ steps.get_file_changes.outputs.files }}
.
.
.
Hope that helps