Skip to content

Commit b8a69fc

Browse files
dvcoldvcol
committed
fix(security): obscur secrets with env variables
1 parent 77bc451 commit b8a69fc

File tree

10 files changed

+114
-8
lines changed

10 files changed

+114
-8
lines changed

‎.github/actions/build/action.yml

+37
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,32 @@ inputs:
1313
description: Node version to use
1414
required: true
1515

16+
trakt_production_id:
17+
description: Trakt production ID
18+
required: true
19+
trakt_production_secret:
20+
description: Trakt production secret
21+
required: true
22+
23+
trakt_staging_id:
24+
description: Trakt staging ID
25+
required: true
26+
trakt_staging_secret:
27+
description: Trakt staging secret
28+
required: true
29+
30+
tmdb_api_key:
31+
description: TMDB API key
32+
required: true
33+
tmdb_read_token:
34+
description: TMDB read token
35+
required: true
36+
37+
tvdb_api_key:
38+
description: TVDB API key
39+
required: true
40+
41+
1642
runs:
1743
using: composite
1844
steps:
@@ -24,6 +50,17 @@ runs:
2450

2551
- name: 🚧 Build sources
2652
shell: bash
53+
env:
54+
VITE_TRAKT_PRODUCTION_ID: ${{ inputs.trakt_production_id }}
55+
VITE_TRAKT_PRODUCTION_SECRET: ${{ inputs.trakt_production_secret }}
56+
57+
VITE_TRAKT_STAGING_ID: ${{ inputs.trakt_staging_id }}
58+
VITE_TRAKT_STAGING_SECRET: ${{ inputs.trakt_staging_secret }}
59+
60+
VITE_TMDB_API_KEY: ${{ inputs.tmdb_api_key }}
61+
VITE_TMDB_READ_TOKEN: ${{ inputs.tmdb_read_token }}
62+
63+
VITE_TVDB_API_KEY: ${{ inputs.tvdb_api_key }}
2764
run: |
2865
# ================= 🚧 Build =================
2966
pnpm run ${{ inputs.script }}

‎.github/workflows/build.yml

+22
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,17 @@ jobs:
3333
node_version: ${{ env.node_version }}
3434
pnpm_version: ${{ env.pnpm_version }}
3535

36+
trakt_production_id: ${{ secrets.VITE_TRAKT_PRODUCTION_ID }}
37+
trakt_production_secret: ${{ secrets.VITE_TRAKT_PRODUCTION_SECRET }}
38+
39+
trakt_staging_id: ${{ secrets.VITE_TRAKT_STAGING_ID }}
40+
trakt_staging_secret: ${{ secrets.VITE_TRAKT_STAGING_SECRET }}
41+
42+
tmdb_api_key: ${{ secrets.VITE_TMDB_API_KEY }}
43+
tmdb_read_token: ${{ secrets.VITE_TMDB_READ_TOKEN }}
44+
45+
tvdb_api_key: ${{ secrets.VITE_TVDB_API_KEY }}
46+
3647
build-web:
3748
name: ☁️ Build Web
3849
runs-on: ubuntu-latest
@@ -48,6 +59,17 @@ jobs:
4859
node_version: ${{ env.node_version }}
4960
pnpm_version: ${{ env.pnpm_version }}
5061

62+
trakt_production_id: ${{ secrets.VITE_TRAKT_PRODUCTION_ID }}
63+
trakt_production_secret: ${{ secrets.VITE_TRAKT_PRODUCTION_SECRET }}
64+
65+
trakt_staging_id: ${{ secrets.VITE_TRAKT_STAGING_ID }}
66+
trakt_staging_secret: ${{ secrets.VITE_TRAKT_STAGING_SECRET }}
67+
68+
tmdb_api_key: ${{ secrets.VITE_TMDB_API_KEY }}
69+
tmdb_read_token: ${{ secrets.VITE_TMDB_READ_TOKEN }}
70+
71+
tvdb_api_key: ${{ secrets.VITE_TVDB_API_KEY }}
72+
5173
test:
5274
name: 🧪 Unit Test
5375
runs-on: ubuntu-latest

‎.github/workflows/deploy.yml

+11
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,17 @@ jobs:
5151
node_version: ${{ env.node_version }}
5252
pnpm_version: ${{ env.pnpm_version }}
5353

54+
trakt_production_id: ${{ secrets.VITE_TRAKT_PRODUCTION_ID }}
55+
trakt_production_secret: ${{ secrets.VITE_TRAKT_PRODUCTION_SECRET }}
56+
57+
trakt_staging_id: ${{ secrets.VITE_TRAKT_STAGING_ID }}
58+
trakt_staging_secret: ${{ secrets.VITE_TRAKT_STAGING_SECRET }}
59+
60+
tmdb_api_key: ${{ secrets.VITE_TMDB_API_KEY }}
61+
tmdb_read_token: ${{ secrets.VITE_TMDB_READ_TOKEN }}
62+
63+
tvdb_api_key: ${{ secrets.VITE_TVDB_API_KEY }}
64+
5465
- name: 🏗️ Setup Pages
5566
uses: actions/configure-pages@v5
5667

‎.github/workflows/publish.yml

+22
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,17 @@ jobs:
4242
node_version: ${{ env.node_version }}
4343
pnpm_version: ${{ env.pnpm_version }}
4444

45+
trakt_production_id: ${{ secrets.VITE_TRAKT_PRODUCTION_ID }}
46+
trakt_production_secret: ${{ secrets.VITE_TRAKT_PRODUCTION_SECRET }}
47+
48+
trakt_staging_id: ${{ secrets.VITE_TRAKT_STAGING_ID }}
49+
trakt_staging_secret: ${{ secrets.VITE_TRAKT_STAGING_SECRET }}
50+
51+
tmdb_api_key: ${{ secrets.VITE_TMDB_API_KEY }}
52+
tmdb_read_token: ${{ secrets.VITE_TMDB_READ_TOKEN }}
53+
54+
tvdb_api_key: ${{ secrets.VITE_TVDB_API_KEY }}
55+
4556
- name: 💾 Restore build artefacts
4657
uses: actions/cache/save@v4
4758
id: cache
@@ -77,6 +88,17 @@ jobs:
7788
node_version: ${{ env.node_version }}
7889
pnpm_version: ${{ env.pnpm_version }}
7990

91+
trakt_production_id: ${{ secrets.VITE_TRAKT_PRODUCTION_ID }}
92+
trakt_production_secret: ${{ secrets.VITE_TRAKT_PRODUCTION_SECRET }}
93+
94+
trakt_staging_id: ${{ secrets.VITE_TRAKT_STAGING_ID }}
95+
trakt_staging_secret: ${{ secrets.VITE_TRAKT_STAGING_SECRET }}
96+
97+
tmdb_api_key: ${{ secrets.VITE_TMDB_API_KEY }}
98+
tmdb_read_token: ${{ secrets.VITE_TMDB_READ_TOKEN }}
99+
100+
tvdb_api_key: ${{ secrets.VITE_TVDB_API_KEY }}
101+
80102
- name: 🗃️ Zip build folder
81103
run: |
82104
# ================= 🗃️ Zipping build folder =================

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -114,3 +114,6 @@ dist
114114
*.njsproj
115115
*.sln
116116
*.sw?
117+
118+
#env files
119+
.env.local

‎env.d.ts

+11
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,16 @@ interface ImportMeta {
66
VITE_BASE?: string;
77
VITE_WEB?: boolean;
88
VITE_SOURCEMAP?: boolean;
9+
10+
VITE_TRAKT_PRODUCTION_ID: string;
11+
VITE_TRAKT_PRODUCTION_SECRET: string;
12+
13+
VITE_TRAKT_STAGING_ID: string;
14+
VITE_TRAKT_STAGING_SECRET: string;
15+
16+
VITE_TMDB_API_KEY: string;
17+
VITE_TMDB_READ_TOKEN: string;
18+
19+
VITE_TVDB_API_KEY: string;
920
};
1021
}

‎src/settings/tmdb.api.ts

+2-3
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@ import type { TmdbClientSettings } from '~/models/tmdb/tmdb-client.model';
33
export const Config = {
44
UserAgent: `${import.meta.env.PKG_NAME}/${import.meta.env.PKG_VERSION}`,
55
endpoint: 'https://api.themoviedb.org',
6-
apiKey: '2ba5f96dda8c09e647721c23b69a3533',
7-
readToken:
8-
'eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiIyYmE1Zjk2ZGRhOGMwOWU2NDc3MjFjMjNiNjlhMzUzMyIsInN1YiI6IjY1YjY3MzUwMWM2MzViMDE2MjE0MGRkMyIsInNjb3BlcyI6WyJhcGlfcmVhZCJdLCJ2ZXJzaW9uIjoxfQ.lcJ-RqF9ELLotwyrPze7Q-fRyTJhDxrxad1LxHpYdwY',
6+
apiKey: import.meta.env.VITE_TMDB_API_KEY,
7+
readToken: import.meta.env.VITE_TMDB_READ_TOKEN,
98
requestTokenTTL: 15 * 60 * 1000,
109
requestTokenUrl: 'https://www.themoviedb.org/auth/access?request_token=',
1110
} as const;

‎src/settings/traktv.api.ts

+4-4
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ export const Config = {
88
};
99

1010
export const Production = {
11-
ID: '4f2745eb6a58949bd35f4948b70d0dd7184462841052fa11f24d85edc1256a22',
12-
Secret: '322d3d1a6d6d9214a1fc120903c8722b266e7643bd708e437ddbb68f5c737fa2',
11+
ID: import.meta.env.VITE_TRAKT_PRODUCTION_ID,
12+
Secret: import.meta.env.VITE_TRAKT_PRODUCTION_SECRET,
1313
TraktEndpoint: 'https://api.trakt.tv',
1414
RedirectionUrl: `chrome-extension://${chromeRuntimeId}/views/options/index.html`,
1515
} as const;
1616

1717
export const Staging = {
18-
ID: 'e3fe38d76cbd787f74ada8f043a69dfc8b20a86569e51ee125bf0c084d6c553c',
19-
Secret: '14780b6623c64337f442b06603a5484b9422c4fe3ced7e109a1e0f795a708752',
18+
ID: import.meta.env.VITE_TRAKT_STAGING_ID,
19+
Secret: import.meta.env.VITE_TRAKT_STAGING_SECRET,
2020
TraktEndpoint: 'https://api-staging.trakt.tv',
2121
RedirectionUrl: `chrome-extension://${chromeRuntimeId}/views/options/index.html`,
2222
} as const;

‎src/settings/tvdb.api.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ export const Config = {
44
UserAgent: `${import.meta.env.PKG_NAME}/${import.meta.env.PKG_VERSION}`,
55
endpoint: 'https://api4.thetvdb.com',
66
version: 'v4',
7-
apiKey: '7633408c-e021-43a5-a04a-9f057ab68880',
7+
apiKey: import.meta.env.VITE_TVDB_API_KEY,
88
/** token time-to-live (28 days) @see [documentation]{@link https://thetvdb.github.io/v4-api/#/Login/post_login} */
99
tokenTTL: 28 * 24 * 60 * 60 * 1000,
1010
} as const;

‎vite.config.ts

+1
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ const getPlugins = (): PluginOption[] => [
113113

114114
export default defineConfig(() => ({
115115
root: resolveParent('src'),
116+
envDir: resolveParent('env'),
116117
resolve: {
117118
alias: {
118119
'~': fileURLToPath(new URL('./src', import.meta.url)),

0 commit comments

Comments
 (0)