config Secrets's problem

[ruoduan-hub]

How to use "secrets.xxx" of "github" in "gatsby-config.js" to hide the secret key?

[LekoArts]

Hi!

I'm afraid you'll need to share some more details about your inquiry in order to help :)

[ruoduan-hub]

• thank you for your reply ！

When I use "gatsbyjs", the plugins in "gatsby-config.js" involve some keys, but my project is open source, and I don’t want these keys to be leaked

[LekoArts]

We've got a doc about that here: https://www.gatsbyjs.com/docs/how-to/local-development/environment-variables
And GitHub here: https://docs.github.com/en/actions/reference/encrypted-secrets

So generally speaking you'll want to use your environment variables inside gatsby-config like:

module.exports = {
  plugins: [
    {
      resolve: `your-plugin`,
      options: {
        key: process.env.YOUR_VAR,
      },
    },
  ],
}

And if you then use GitHub actions you can define YOUR_VAR with the secrets. If you don't use GitHub actions then the secrets are the wrong place to store the env vars.

[ruoduan-hub]

Very glad you can answer! 👍

• I have only used "encrypted-secrets" in "github Action". If it is used in "gatsby-config.js", put it in ".evn" and then use ".evn" in "config". encrypted-secrets"?

E.g：

• .evn

MY_ID = ${{ secrets.GITHUB_ID }} 

• gatsby-config.js

process.env.MY_ID

Does it probably mean this?

[LekoArts]

Yeah, that should work. If you do this (like shown here: https://docs.github.com/en/actions/reference/encrypted-secrets#using-encrypted-secrets-in-a-workflow):

steps:
  - name: Hello world action
    env:
      MY_ID: ${{ secrets.GITHUB_ID }}

Then you should be able to do:

module.exports = {
  plugins: [
    {
      resolve: `your-plugin`,
      options: {
        key: process.env.MY_ID,
      },
    },
  ],
}

[ruoduan-hub]

Hello my friend!

The above method does not work 👆🏻

The variable obtained by ".ymi" 👉🏻 "${{ secrets.GITHUB_ID }}" can only be used in ".yml", and cannot be used by me in "gatsby-config.js";

[ruoduan-hub]

thank you very much !

I used the "bash" script to solve this need, and my solution is as follows: 👇🏻

1. Write a "bash" script in "GitHub Actions" to produce a ".env.production" file
2. Use "process.env.VALINE_APPID" directly in "JSX" to get environment variables. The script is very simple as follows: 👇🏻:

  -name: Create .env.production
       run: echo -e "VALINE_APPID=${{secrets.VALINE_APPID}}\nVALINE_APPKEY=${{secrets.VALINE_APPKEY}}"> .env.production

3. The local ".env" variable is used for local debugging.

I wish you a happy life! ☀️