Our application is growing and I need an admin panel. So I've decided to make use of Laravel Nova. Now, Nova is a paid, premium product, and so we can't just fetch the code from packages.org. Like a number of products that you might find yourself wanting to use, we declare a satis repository inside composer.json, which is where the Nova source code will be pulled from. Now, locally, I have this auth.json file, and auth.json contains information about the username and the key, the password, that will be used to fetch Nova. By the way, of course, I've already cycled this token by the time you're seeing this episode,

that will be used to fetch Nova. By the way, of course, I've already cycled this token by the time you're seeing this episode, so don't try and copy and paste it. You will literally be wasting your time. Of course, we don't want to push auth.json into source control. It contains private information that should stay private, so it's gitignored. But that means that our workflow has stopped working, because when it tries to install project dependencies, it comes across this Nova dependency and it goes, whoa, I don't have anywhere enough detail to be able to actually install from that repository.

it comes across this Nova dependency and it goes, whoa, I don't have anywhere enough detail to be able to actually install from that repository. So how do we fix this? The solution is to authenticate Nova just before we install project dependencies inside our workflow file. So inside test.yaml, I'm going to come just up here before install project dependencies, and I'm going to authenticate Nova. And we'll run a bash command for this. Now, if you go to the Nova documentation, they actually give you this composer command,

Now, if you go to the Nova documentation, they actually give you this composer command, which allows you to easily authenticate with any given repository. In this case, nova.larivore.com. We pass our email, luke@downing.tech, and we pass our password. But of course, if you drop these into your workflow file in plain text, you've done nothing in the name of security. You'd be just as well committing auth.json. Instead, we need to inject these variables in from outside the workflow. To do that, I'm going to head to the repository settings on GitHub,

Instead, we need to inject these variables in from outside the workflow. To do that, I'm going to head to the repository settings on GitHub, and down the left-hand side, I'll search for security, secrets and variables, actions. Now, what's the difference between a secret and a variable? A secret is encrypted. It's used for private information, whereas a variable is information you want to be able to quickly alter from GitHub, but it isn't secret. It will be stored in plain text. We're going to use secrets for both the email and the password to authenticate Nova. Let's come down to repository secrets, and we'll create a new repository secret. Let's call this one nova-email, and we'll set the value to luke@downing.tech.

Let's come down to repository secrets, and we'll create a new repository secret. Let's call this one nova-email, and we'll set the value to luke@downing.tech. Add the secret, and then we can come down and add a new repository secret, this time nova-password. Let's go back. We'll head to our auth.json file, grab this key, and then I can drop that in as the secret and click add. With these secrets added, we should now be able to make use of them inside our GitHub Action workflow. We'll start by replacing these hard-coded values with environment variables. We would say nova-email, and we would say nova-password.

We'll start by replacing these hard-coded values with environment variables. We would say nova-email, and we would say nova-password. Note that I've wrapped both of these in double quotes, because certainly the secret, the password, might contain special characters that could really mess with Bash. The double quotes will escape that. Then we can pass these environment variables in. We'll start with nova-email, which I'm going to set using that GitHub syntax to secrets.nova-email. That secrets object will contain any secrets that we've configured for this repository.

to secrets.nova-email. That secrets object will contain any secrets that we've configured for this repository. Let's also add our nova-password. We'll set this one to secrets.nova-password, and we should be good to go at this. We should successfully be able to authenticate Nova. Let's push it up and see what happens. What happened was it worked. We successfully authenticated Nova using that email and password. You can see that GitHub is going to automatically hide those variables.

We successfully authenticated Nova using that email and password. You can see that GitHub is going to automatically hide those variables. You won't be able to see them from the output, which is pretty cool, but you can obviously manage them from the GitHub panel however you'd like. Now when we run composer install, there are no errors. It installs without issue. Now, you might be thinking to yourself, hey, seeing as we created this cool setup composite action in the previous episode, could we not authenticate Nova in there, and that would mean that every workflow would benefit.

in the previous episode, could we not authenticate Nova in there, and that would mean that every workflow would benefit from automatic Nova authentication? Yeah, you can, but there is a caveat. Let's just talk about that quickly. We'll cut our authenticateNova action out from test.yaml, and we'll head into the setup action. Of course, we can then drop this in place. Because we're using run, we'll need to define that the shell is bash. Now, here's the caveat.

Because we're using run, we'll need to define that the shell is bash. Now, here's the caveat. You don't have access to secrets inside a composite action. The reason is quite simple. These actions are intended to be shared, to be used. You could put them on the GitHub marketplace. Wouldn't really be great for security if they had full access to all the secrets. So we'd have to pass these secrets in from our workflow file. In order to do that, we could set up a new piece of input.

So we'd have to pass these secrets in from our workflow file. In order to do that, we could set up a new piece of input. We could say novaEmail. We would create a description. The email used to authenticate Nova. Then we would say that it is a required piece of information, and then we could do the same with password. novaPassword, description, the password used to authenticate Nova. Then we'll also say that that is a required field. Now, if we head down to where we're actually making use of that,

Then we'll also say that that is a required field. Now, if we head down to where we're actually making use of that, rather than passing in secrets, we would reach for that inputs object again, passing in the Nova email, and we would reach for the inputs object here, passing in the Nova password. Now, as you can imagine, don't really have to tell you this, when we go back to the setup action, we're going to need to pass in the Nova email.

when we go back to the setup action, we're going to need to pass in the nova email. Let's set that to the secret that we've been given, secrets.nova_email, and the nova password, which we'll set to nova_password. And you'll want to copy this and paste it anywhere you make use of the setup function. In our case, that would be in our Laravel Pint setup. Yep, we'll drop this here, and now that will work.

In our case, that would be in our Laravel Pint setup. Yep, we'll drop this here, and now that will work. So, you'll have to decide whether you think it's worth the hassle of adding it to the setup action, but if you do, just keep that in mind, secrets and variables are not passed on to composite actions. Okay, that's all there is to it. Now you know how to authenticate private packages and how to make use of secrets to hide sensitive information inside your workflow files.

and how to make use of secrets to hide sensitive information inside your workflow files. Microsoft Mechanics www.microsoft.com