GitHub Actions secrets (App)
Export secrets into a GitHub repository or environment through our GitHub App.
Export secrets into a GitHub repository or environment through our GitHub App.
This connection is planned. The card is in the console, and you cannot connect it yet. This page describes what it will do.
Connection
| What | This provider |
|---|---|
| Vendor | GitHub |
| Key | github-actions-secrets-app |
| Availability | planned. The card is in the console, and you cannot connect it yet. |
| Credential we hold | github-app-installation |
| Values read back | no |
| Activation | immediate |
Directions
| Direction | What it does |
|---|---|
export | We write names and values from your environment into the store. |
GitHub returns no value once it holds one, so we can write here and cannot read back.
Activation
immediate. The running app sees a new value at once.
Conflict policies
| Direction | Policies you can pick |
|---|---|
export | create_only, overwrite, overwrite_and_prune |
How syncs work says what each one does.
Connect
You grant us access in your own GitHub account. Pick one of these methods in the wizard.
We store no secret of yours. The sealed field is an id, and our own key makes it work.
Install the penv GitHub App
We hold no token of yours; each sync mints its own, for one repository, for an hour. Sign in at the vendor and consent. We poll the vendor until the grant appears. This method is planned.
Set aside about 1 minute.
- Choose the account or organization whose repositories this workspace syncs to.
- Pick the repositories the App may reach. That list is yours to change later, and we cannot widen it.
- Approve the install and come back; this page finishes on its own.
Mapping fields
You answer these once per environment you map.
| Field | Label | Kind | Required | Advanced | What it is |
|---|---|---|---|---|---|
repository | Repository | text | yes | no | The repository this sync writes to. |
owner | Account | text | yes | no | The account or organization that owns it. |
environment | Environment | text | no | yes | Leave empty for the repository's own store. An environment must already exist. |
Required permissions
We probe for these when we verify the connection.
| Permission | Directions | Blocking | Without it |
|---|---|---|---|
metadata:read | every direction | yes | We cannot confirm the App is still installed, or which repositories it reaches. |
secrets:write | export | yes | Export cannot write anything. |