Audit repo secrets and variables - Githubissues

nextstrain / nextstrain.org

The Nextstrain website

https://nextstrain.org

GNU Affero General Public License v3.0

87 stars 49 forks source link

Audit repo secrets and variables #903

Open victorlin opened 3 weeks ago

victorlin commented 3 weeks ago

Overview

from https://github.com/nextstrain/nextstrain.org/settings/secrets/actions

Actions
- Environment secrets
  - HEROKU_TOKEN
- Repository secrets
  - DEV_SERVER_AWS_ACCESS_KEY_ID
  - DEV_SERVER_AWS_SECRET_ACCESS_KEY
- Organization secrets
  - DOCKER_TOKEN_PUBLIC_READ_ONLY
  - HEROKU_TOKEN_READ_PROTECTED
  - SLACK_TOKEN
- Organization variables
  - AWS_DEFAULT_REGION
  - TEST_SLACK_CHANNEL
Dependabot
- Repository secrets
  - AWS_DEFAULT_REGION
  - DEV_SERVER_AWS_ACCESS_KEY_ID
  - DEV_SERVER_AWS_SECRET_ACCESS_KEY
  - HEROKU_TOKEN
  - HEROKU_TOKEN_READ_PROTECTED
  - HEROKU_USER
- Organization secrets
  - GH_TOKEN_NEXTSTRAIN_BOT_REPO

Tasks

[ ] Move Dependabot's HEROKU_TOKEN_READ_PROTECTED to the organization level to match Actions secret
[ ] Remove these from Dependabot because they're already available as organization variables
- AWS_DEFAULT_REGION
- HEROKU_USER
[ ] Remove HEROKU_TOKEN from Dependabot because we don't use Dependabot PRs to deploy to Heroku