About secrets

• Naming your secrets The following rules apply to secret names:
• Accessing your secrets To make a secret available to an action, you must set the secret as an input or environment variable in the workflow file.
• Limiting credential permissions When generating credentials, we recommend that you grant the minimum permissions possible.

It boils down to 3 steps:

1. Build your encrypted .env.vault file and commit that safely to code. This contains an encrypted copy of your CI secrets.
2. Set a single DOTENV_KEY environment variable on GitHub Actions
3. When the CI runs it will use the DOTENV_KEY to decrypt the contents of your .env.vault and inject your environment variables just in time.

Storing large secrets

1. Run the following command from your terminal to encrypt the file containing your secret using gpg and the AES256 cipher algorithm.
2. You will be prompted to enter a passphrase.
3. Create a new secret that contains the passphrase.
4. Copy your encrypted file to a path in your repository and commit it.
5. Create a shell script in your repository to decrypt the secret file.