As a developer, you are authoring a workflow that will deploy to both DevCloud and TestCloud resources. Each cloud resource is accessed with a different deployment key. Which approach best allows…

Question

Options

• APopulate a DEPLOY_KEY repository secret with a JSON object containing DevCloud and
• BUse a marketplace action to conditionally parse the DEPLOY_KEY repository secret based on the
• CStore the different keys in a DEPLOY_KEY environment secret in the DevCloud and TestCloud
• DCreate repository secrets named DevCloud.DEPLOY_KEY and TestCloud.DEPLOY_KEY so that

• A
  1% (1)
• B
  6% (4)
• C
  81% (57)
• D
  11% (8)

Explanation

The cleanest solution is to create two GitHub environments named 'DevCloud' and 'TestCloud', each containing an environment secret with the same name (e.g., DEPLOY_KEY) but different values. When a job references a specific environment, GitHub injects that environment's version of the secret. The same reusable workflow can reference DEPLOY_KEY without any conditional logic, and the correct key is automatically supplied based on which environment the calling job targets. Option A is wrong because parsing a JSON blob adds fragility and complexity. Option B adds unnecessary marketplace dependencies and conditional parsing. Option D using dot-notation secret names (DevCloud.DEPLOY_KEY) is not valid GitHub secret naming syntax and would require conditional logic in the workflow to select the right secret.

No community discussion yet for this question.