Using secrets for code and database credentials #26264

HSoeren · 2020-10-04T22:38:58Z

HSoeren
Oct 4, 2020

Hi there

I am currently working with colleagues on a small webapp that is based on PHP and a database.

We have set up a workflow where every push to the master branch copies the repository to our test webserver.

Until now we have always worked with ZIP files and email - now that is automated and simplified but now we fail because the secrets do not work as we want them to.

We don’t want to store the real database accesses, but rather a variable that is replaced by the real credential when it is delivered to the web server, so that the web server gets a running webapp while there is no critical data in the repository.

Is there a way to automate this or do we have to upload manually again?

Thank you very much in advance!

Answered by Simran-B

Oct 6, 2020

Something along the following, with the database password stored as GitHub secret with name SCRIPT_CREDENTIALS:

steps:
  - name: Execute script
    env:
      PASSWORD: ${{ secrets.SCRIPT_CREDENTIALS }}
    run: php script.php

script.php:

<?php
$servername = "localhost";
$username = "username";
$password = getenv("PASSWORD");
$conn = new mysqli($servername, $username, $password);
if ($conn->connect_error) {

die("Connection failed: " . $conn->connect_error);

}

echo "Connected successfully";

?>

php.net

PHP: getenv - Manual

View full answer

Simran-B · 2020-10-05T12:56:34Z

Simran-B
Oct 5, 2020

That’s what GitHub secrets are, aren’t they?

docs.github.com

Encrypted secrets - GitHub Docs

0 replies

HSoeren · 2020-10-06T10:32:15Z

HSoeren
Oct 6, 2020
Author

Yes exactly. I use them always for the Action / Deploy process to store my FTP credentials in it. But now i have a repository cotaining a php file with credentials for my database and i dont want to expose them. I hoped that there is a way to hide them with with secrets.

0 replies

HSoeren · 2020-10-06T10:35:02Z

HSoeren
Oct 6, 2020
Author

idea; can I create a file via cat ${{ SECRET }} > file.php in the workflow? If so, I would have the file containing the access data created by the workflow…?

0 replies

airtower-luna · 2020-10-06T11:19:34Z

airtower-luna
Oct 6, 2020

I haven’t tested it personally, but the documentation describes how to commit an encrypted file and decrypt it using a secret. Maybe that would help?

0 replies

Simran-B · 2020-10-06T11:57:42Z

Simran-B
Oct 6, 2020

Having any sort of credentials hardcoded in a PHP file sounds like a bad idea. Why don’t you you let PHP read the credentials from environment variables for instance?

0 replies

HSoeren · 2020-10-06T14:27:45Z

HSoeren
Oct 6, 2020
Author

Can you be more specific? I know there is such a thing, but I don’t think I’ve really worked with it.

0 replies

Simran-B · 2020-10-06T20:13:35Z

Simran-B
Oct 6, 2020

Something along the following, with the database password stored as GitHub secret with name SCRIPT_CREDENTIALS:

steps:
  - name: Execute script
    env:
      PASSWORD: ${{ secrets.SCRIPT_CREDENTIALS }}
    run: php script.php

script.php:

<?php
$servername = "localhost";
$username = "username";
$password = getenv("PASSWORD");
$conn = new mysqli($servername, $username, $password);
if ($conn->connect_error) {

die("Connection failed: " . $conn->connect_error);

}

echo "Connected successfully";

?>

php.net

PHP: getenv - Manual

0 replies

HSoeren · 2020-10-12T00:52:34Z

HSoeren
Oct 12, 2020
Author

Sorry, I was on the road for a few days and could not test nor answer anything.

Your solution looks good, would do that.

In the converted file on the server you will only find the variables but not the modified data (the content of the variables)

Run php config/db.php
  php config/db.php
  shell: /bin/bash -e {0}
  env:
    SERVER: ***
    USERNAME: ***
    PASSWORD: ***
PHP Warning:  mysqli::__construct(): (HY000/2002): No such file or directory in /home/runner/work/dcd-test/dcd-test/config/db.php on line 6
PHP Stack trace:
PHP   1. {main}() /home/runner/work/dcd-test/dcd-test/config/db.php:0
PHP   2. mysqli->__construct() /home/runner/work/dcd-test/dcd-test/config/db.php:6
Connection failed: No such file or directory

The folder is in the correct path on the server, it just seems like the php command doesn’t work. Does that need a special package?

0 replies

Simran-B · 2020-10-12T07:58:12Z

Simran-B
Oct 12, 2020

Can you check what the working directory is with pwd?

Looks like it cannot find config/db.php relative to the current working directory. Although the last log entry says “Connection failed”, which seems a bit odd.

0 replies

canovasjm · 2020-12-16T23:57:18Z

canovasjm
Dec 16, 2020

Thanks a lot for this!. I want to do the same using python and email credentials, instead. In python I’m using os.environ.get() to read the secrets, but with no success so far. Any ideas on how to do it with python?

0 replies

airtower-luna · 2020-12-17T15:02:56Z

airtower-luna
Dec 17, 2020

To quote from your Stackoverflow post:

- name: execute py script # run sj-gobierno.py to get the latest data
  env: | 
    EMAIL_ADDRESS: ${{ secrets.EMAIL_ADDRESS }}
    EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}

The problem is that you’re turning setting a text block for env, instead of individual keys. Correct version:

- name: execute py script # run sj-gobierno.py to get the latest data
  env:
    EMAIL_ADDRESS: ${{ secrets.EMAIL_ADDRESS }}
    EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}

I also highly recommend moving the pip install to a separate, previous step so it doesn’t have access to the secrets. Principle of least privilege and all that.

0 replies

canovasjm · 2020-12-18T15:07:32Z

canovasjm
Dec 18, 2020

Thank you, it worked!. And thank you for the recommendation to move pip install to a previous step. For others interested in using secrets inside python, I can confirm that os.environ.get() does the job.

0 replies

LaxmanMaharjan · 2021-04-25T09:46:45Z

LaxmanMaharjan
Apr 25, 2021

.py file

	import smtplib
	import os
	from email.message import EmailMessage

	EMAIL_ADDRESS = os.environ[‘EMAIL_ADDRESS’]
	EMAIL_PASSWORD = os.environ[‘EMAIL_PASSWORD’]

	msg = EmailMessage()
	msg[‘Subject’] = ‘Checking smtplib FROM GITHUB’
	msg[‘From’] = EMAIL_ADDRESS
	msg[‘To’] = ‘lxmnmrzn@gmail.com’

	msg.set_content(‘This is a email check.’)


	with smtplib.SMTP_SSL(‘smtp.gmail.com’, 465) as smtp:
	smtp.login(EMAIL_ADDRESS, EMAIL_PASSWORD)
	smtp.send_message(msg)

.yml file

name: execute py script
env:
EMAIL_ADDRESS: {{ secrets.EMAIL_ADDRESS }} EMAIL_PASSWORD: {{ secrets.EMAIL_PASSWORD }}

ERROR
smtp.login(EMAIL_ADDRESS, EMAIL_PASSWORD)
can only concatenate str (not “bytes”) to str

Please help me solve this problem

0 replies

Simran-B · 2021-04-25T22:09:54Z

Simran-B
Apr 25, 2021

Are you using Python 2?
os.environ['...'].decode('utf8') might do the trick.

0 replies

LaxmanMaharjan · 2021-04-26T07:05:05Z

LaxmanMaharjan
Apr 26, 2021

There was an issue with the GitHub secrets, was setting secrets in environment instead of repo.
@canovasjm helped me solve it.
Thank you @Simran-B @canovasjm

0 replies

maheshmnj · 2021-06-13T16:04:24Z

maheshmnj
Jun 13, 2021

I am trying to use the above approach in a flutter web app with no success,
Currently I have a secret key hardcoded in my app in a *.dart file
Is it possible to access the github secrets directly in the code?
e.g I have

final secret = "*******";

can I replace it with

final secret =${{secrets.myKey }}

0 replies

airtower-luna · 2021-06-13T16:09:51Z

airtower-luna
Jun 13, 2021

maheshmnj:

Is it possible to access the github secrets directly in the code?

No, because your code isn’t processed by the workflow parser. In general it’s better to read the secret value from an environment variable or configuration file at runtime. Your workflow can then set that environment variable from a secret, or write the configuration file before calling your application.

0 replies

maheshmnj · 2021-06-13T16:40:16Z

maheshmnj
Jun 13, 2021

Thanks for the reply
I am not much familiar with these scripts

- name: execute py script # run sj-gobierno.py to get the latest data
  env:
    EMAIL_ADDRESS: ${{ secrets.EMAIL_ADDRESS }}
    EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}

Does the env file has to be already present or will it get created with the content?

and what should the run key do I did not specify the run key and the test failed with an error

every step must define a `uses` or `run` key```

0 replies

airtower-luna · 2021-06-13T17:37:56Z

airtower-luna
Jun 13, 2021

The run key defines the command to run. Based the comment in your example it should probably look similar to this:

- name: execute py script
  run: python3 sj-gobierno.py
  env:
    EMAIL_ADDRESS: ${{ secrets.EMAIL_ADDRESS }}
    EMAIL_PASSWORD: ${{ secrets.EMAIL_PASSWORD }}

What you define in env will be available to the script as environment variables, not in a file. For accessing environment variables in Python, see os.environ.

0 replies

ozcanteters · 2023-03-20T18:45:12Z

ozcanteters
Mar 20, 2023

Hi from 2023,
how to i use this on c#?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

Using secrets for code and database credentials #26264

{{title}}

Replies: 20 comments

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Using secrets for code and database credentials #26264

Replies: 20 comments

HSoeren Oct 6, 2020 Author

HSoeren Oct 6, 2020 Author

HSoeren Oct 6, 2020 Author

HSoeren Oct 12, 2020 Author

HSoeren
Oct 6, 2020
Author

HSoeren
Oct 6, 2020
Author

HSoeren
Oct 6, 2020
Author

HSoeren
Oct 12, 2020
Author