How to transfer secrets securely? #599
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
When running the runner locally, the only way to transfer secrets seems to be through the "-s" flag on the CLI. This is problematic, because then the secrets is kept on the history of the terminal. Is there any better way of doing this, through a file or so?
The local mode should only be used on development machines. It’s not advisable to use it on a production machine. Additionally, even on development machines, it’s always better to hide sensitive information than to leave it exposed.
@lunny I see that act_runner is based on nektos/act, and that support for "--secrets-file" (defaulting to .secret) has been in place since 4 years ago. What is the reason for removing this from act? I can make a pull request bringing in the corresponding code to support secrets from nektos/act, but I want to make sure I am not breaking any design principles or something like that.
@lunny ? Did you see my previous question? Depending on your answer I can try to put everything together.
act_runner doesn't need to read the secrets in the file. The secrets will be transferred from Gitea to the task container.
@lunny What you say is true for whenever the workflow is being run through gitea, but I think that is not the case when I am running the workflow through a standalone runner locally. Whenever debugging workflows, is handy to have the possibility to do this locally.