Skip to content

secrets-and-vars.md

Latest commit

聽

History

History
59 lines (49 loc) 路 4.45 KB

secrets-and-vars.md

File metadata and controls

59 lines (49 loc) 路 4.45 KB
Raw

馃攼 Organization Secrets & Variables

Organization-level secrets and variables referenced across actions and reusable workflows.

Name Purpose Owner
secrets.AWS_S3_ACCESS_KEY_ID Specific AWS S3 access key ID for S3-specific operations in AT cases. Qubership
secrets.AWS_S3_ACCESS_KEY_SECRET Secret key paired with AWS_S3_ACCESS_KEY_ID for S3-specific operations in AT cases. Qubership
secrets.CLA_ACCESS_TOKEN Token for CLA workflow to read/write contributor license agreement storage. Company
secrets.DOCKERHUB_RW_TOKEN Access token / password for the Docker Hub user with read/write (and possibly delete) permissions; used for docker login prior to build & push steps. Rotate if leaked. Company
secrets.DOCKERHUB_USER Docker Hub account username used for authenticating when pushing images or increasing anonymous pull rate limits. Company
secrets.GH_ACCESS_TOKEN PAT for a technical (service) user with extended repository / package permissions beyond GITHUB_TOKEN. Company
secrets.GH_BUMP_VERSION_APP_KEY GitHub App Key used for automated version bumping processes. Can bypass branch protection rules. Company
secrets.GH_RWD_PACKAGE_TOKEN PAT with read / write / delete permissions for GitHub Packages (publishing & cleanup). Company
secrets.GITHUB_TOKEN Ephemeral GitHub-provided token (scoped to repository). Used for checkout, pushing commits/tags, creating releases. Company
secrets.MAVEN_GPG_PASSPHRASE Passphrase unlocking the GPG private key. Company
secrets.MAVEN_GPG_PRIVATE_KEY ASCII鈥慳rmored GPG private key used to sign Maven artifacts (JAR, POM, etc.). Company
secrets.MAVEN_PASSWORD Password / token paired with MAVEN_USER for Maven Central publishing. Company
secrets.MAVEN_RELEASE_DEV_TOKEN GitHub token with packages write permissions. USed in semantic-release process by cloud core Company
secrets.MAVEN_USER Username for authenticating to Maven Central when publishing release artifacts. Company
secrets.PYPI_API_TOKEN API token for publishing Python packages to PyPI. Company
secrets.PYPI_API_USER API user name for publishing Python packages to PyPI. Company
secrets.SONAR_TOKEN Token to authenticate with SonarQube / SonarCloud for code quality analysis. Company
secrets.WORKFLOWS_TOKEN Classic PAT including workflow scope (needed to trigger/modify workflows or dispatch across repository). Deprecated. Replaced by secrets.GH_ACCESS_TOKEN. Company
secrets.EMAIL_PASSWORD SMTP password or Gmail App Password for sending email notifications via email-action. Company

Organization Variables

Name Purpose
GH_BUMP_VERSION_APP_ID GitHub App ID used for automated version bumping processes. Paired with secrets.GH_BUMP_VERSION_APP_KEY.
SONAR_HOST_URL URL of the SonarQube/SonarCloud server for code quality analysis.
SONAR_ORGANIZATION Organization identifier in SonarQube/SonarCloud for project association.
SONAR_PLUGIN_VERSION Version of the SonarQube plugin to use in analysis workflows.
EMAIL_SMTP_HOST SMTP server hostname for email notifications (e.g. smtp.gmail.com). Used by email-action.
EMAIL_SMTP_PORT SMTP server port for email notifications (e.g. 587 for STARTTLS). Used by email-action.
EMAIL_FROM Sender email address for notifications (e.g. noreply.qubership@gmail.com). Used by email-action.

Usage Guidelines

  • Prefer GITHUB_TOKEN when sufficient; use PATs only if extra scopes (workflow dispatch, cross-repository access, delete package) are required.
  • Do not echo secret values; avoid set -x around sensitive commands.
  • Rotate external registry tokens, PATs, and GPG keys periodically (recommended quarterly).
  • Keep CI GPG key separate from personal keys.
  • Validate new or rotated credentials with a dry-run capable workflow before full release tasks.

Rotation Checklist

  1. Generate / rotate credential.
  2. Update at organization (or repository) Secrets.
  3. Invalidate/ revoke old credential where applicable.
  4. Run a dry-run workflow (if supported) to confirm.
  5. Remove any temporary debugging output.

Related Docs