4 - Secrets Management in CI/CD Pipelines

# Accessing repository secrets
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to Firebase
        env:
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
        run: firebase deploy --token "$FIREBASE_TOKEN"

      # Secrets are automatically masked in logs
      - name: Debug (secret shown as ***)
        run: echo "Token is ${{ secrets.FIREBASE_TOKEN }}"
      

# Environment secrets
jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - name: Deploy to staging
        env:
          # Uses the "staging" environment secret
          API_KEY: ${{ secrets.API_KEY }}
          DEPLOY_URL: ${{ vars.DEPLOY_URL }}
        run: |
          echo "Deploying to $DEPLOY_URL"
          firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"

  deploy-production:
    runs-on: ubuntu-latest
    environment: production
    needs: deploy-staging
    steps:
      - name: Deploy to production
        env:
          # Uses the "production" environment secret (different!)
          API_KEY: ${{ secrets.API_KEY }}
        run: firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"
      

# Example: variables vs secrets
jobs:
  build:
    runs-on: ubuntu-latest
    environment: production
    env:
      # Variables: non-sensitive configuration
      API_URL: ${{ vars.API_URL }}
      APP_NAME: ${{ vars.APP_NAME }}
      ENABLE_ANALYTICS: ${{ vars.ENABLE_ANALYTICS }}
    steps:
      - uses: actions/checkout@v4
      - name: Build with environment config
        env:
          # Secrets: sensitive information
          FIREBASE_TOKEN: ${{ secrets.FIREBASE_TOKEN }}
          ANALYTICS_KEY: ${{ secrets.ANALYTICS_KEY }}
        run: |
          echo "Building for $API_URL"
          npm run build -- --configuration=production
      

# .env file structure in the project
project/
  .env                 # NEVER committed (in .gitignore)
  .env.example         # Template WITHOUT real values (committed)
  .env.development     # Development values (optional, in .gitignore)
  .env.production      # NEVER committed, NEVER in the repository
      

# .env.example - Template committed to the repository
# Copy to .env and fill in with real values
API_URL=https://api.example.com
FIREBASE_PROJECT_ID=your-project-id
ANALYTICS_ID=
SECRET_KEY=

# .env - Local file (MUST be in .gitignore)
API_URL=https://api.example.com
FIREBASE_PROJECT_ID=my-actual-project
ANALYTICS_ID=G-XXXXXXXXXX
SECRET_KEY=super-secret-value-123
      

# .gitignore - ALWAYS exclude .env files
.env
.env.local
.env.development.local
.env.test.local
.env.production.local
.env.production

# But do NOT exclude the template
!.env.example
      

// environment.ts - What is safe and what is NOT

// SAFE: public keys with domain restrictions
export const environment = {
  production: true,
  apiUrl: 'https://api.example.com',
  googleMapsKey: 'AIza...',  // OK: restricted by domain in Google console
  analyticsId: 'G-XXXXX',   // OK: it's a public identifier
  sentryDsn: 'https://xxx@sentry.io/123',  // OK: restricted by domain
};

// NEVER DO THIS:
// firebaseAdminKey: 'xxxxx',    // DANGEROUS: full admin access
// stripeSecretKey: 'sk_xxxxx',  // DANGEROUS: payment access
// dbPassword: 'password123',     // DANGEROUS: database access
      

# Inject safe values at build time
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      # Replace placeholders in the environment file
      - name: Configure environment
        run: |
          cat > src/environments/environment.prod.ts << 'ENVEOF'
          export const environment = {
            production: true,
            apiUrl: '${{ vars.API_URL }}',
            analyticsId: '${{ vars.ANALYTICS_ID }}',
          };
          ENVEOF

      - run: npm ci
      - run: npx ng build --configuration=production
      

# Workflow for rotation reminders
name: Secret Rotation Reminder

on:
  schedule:
    - cron: '0 9 1 */3 *'  # First day of every quarter

jobs:
  remind:
    runs-on: ubuntu-latest
    steps:
      - name: Check secret age
        run: |
          echo "Reminder: Time to rotate repository secrets."
          echo "Secrets to check:"
          echo "- FIREBASE_SERVICE_ACCOUNT"
          echo "- NPM_TOKEN"
          echo "- DOCKER_HUB_TOKEN"
          echo "Go to Settings > Secrets to update values."

      - name: Create GitHub Issue
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'Quarterly secret rotation',
              body: 'Time to rotate CI/CD secrets.',
              labels: ['security', 'maintenance']
            });
      

# Integrating HashiCorp Vault with GitHub Actions
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Import Secrets from Vault
        uses: hashicorp/vault-action@v3
        with:
          url: https://vault.example.com
          method: jwt
          role: github-actions
          secrets: |
            secret/data/production/firebase token | FIREBASE_TOKEN ;
            secret/data/production/api key | API_KEY ;

      - name: Use imported secrets
        run: |
          echo "Firebase token is available as env var"
          firebase deploy --token "$FIREBASE_TOKEN"
      

# Install git-secrets
# macOS
brew install git-secrets

# Linux
git clone https://github.com/awslabs/git-secrets.git
cd git-secrets && make install

# Configure in the repository
cd my-project
git secrets --install
git secrets --register-aws

# Add custom patterns
git secrets --add 'FIREBASE_TOKEN[=:]\s*[A-Za-z0-9]+'
git secrets --add 'sk_live_[A-Za-z0-9]+'
git secrets --add 'AIza[0-9A-Za-z\\-_]{35}'

# Scan the existing repository
git secrets --scan
      

# Install husky
npm install -D husky
npx husky init

# Create the pre-commit hook
cat > .husky/pre-commit << 'HOOKEOF'
#!/bin/sh

# Check that no secrets are being committed
echo "Checking for secrets..."

# Common secret patterns
PATTERNS=(
  'AKIA[0-9A-Z]{16}'           # AWS Access Key
  'sk_live_[a-zA-Z0-9]+'       # Stripe Secret Key
  'AIza[0-9A-Za-z\-_]{35}'     # Google API Key
  'ghp_[a-zA-Z0-9]{36}'        # GitHub Personal Token
  'xox[bpoas]-[a-zA-Z0-9-]+'   # Slack Token
)

for pattern in "${PATTERNS[@]}"; do
  if git diff --cached --name-only -z | xargs -0 grep -lP "$pattern" 2>/dev/null; then
    echo "ERROR: Possible secret detected!"
    echo "Pattern: $pattern"
    exit 1
  fi
done

echo "No secrets detected."
HOOKEOF

chmod +x .husky/pre-commit
      

# Workflow with detailed logging
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Log deployment attempt
        run: |
          echo "=== DEPLOYMENT AUDIT LOG ==="
          echo "Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
          echo "Actor: ${{ github.actor }}"
          echo "Ref: ${{ github.ref }}"
          echo "SHA: ${{ github.sha }}"
          echo "Workflow: ${{ github.workflow }}"
          echo "Run ID: ${{ github.run_id }}"
          echo "Environment: production"
          echo "==========================="

      - name: Deploy
        run: firebase deploy --token "${{ secrets.FIREBASE_TOKEN }}"

      - name: Log deployment result
        if: always()
        run: |
          echo "Deploy status: ${{ job.status }}"