GitHub Actions secrets need to be explicitly declared

written by Eric J. Ma on 2024-01-11 | tags: llamabot mistral gpt-4 api key environment variables github actions repository secret workflow step

In this blog post, I share my experience of debugging GitHub Actions for LlamaBot. I encountered a challenge with setting the Mistral API key as an environment variable in my GitHub action. After hours of frustration, I discovered that GitHub Actions can only read a secret if it's explicitly included in a workflow. I explain how to include it in a workflow step. Curious about how to securely manage your API keys in GitHub Actions? Read on!

Today, in releasing a new version of LlamaBot, I also made a change for one of the SimpleBots that I wrote to use the Mistral AI models instead of GPT-4. That meant that I needed to use a Mistral API key as part of the environment variables. However, no matter what I tried, I couldn't seem to get the environment variable set within my GitHub action, even though it was declared as an Actions Repository-level secret.

Turns out, declaring an Actions Repository secret doesn't immediately make it available to the GitHub Actions runner! According to the official documentation,

GitHub Actions can only read a secret if you explicitly include the secret in a workflow.

(Source: GitHub Actions docs)

This turns out to be a great security practice, even if it caused me no end of frustration for over 3 hours this evening. But how do we include it in a workflow step? It is done this way:

    - step:
      - name: Write release notes
        ##### PAY ATTENTION HERE! #####
        env:
          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
        ##### PAY ATTENTION HERE! #####
        run: |
          python -m pip install -e .
          llamabot configure api-key --api-key="${{ secrets.OPENAI_API_KEY }}"
          llamabot configure default-model --model-name="${{ secrets.DEFAULT_LANGUAGE_MODEL }}"
          llamabot git write-release-notes # <-- this line needs access to the MISTRAL_API_KEY environment variable!

Cite this blog post:

@article{
    ericmjl-2024-github-actions-secrets-need-to-be-explicitly-declared,
    author = {Eric J. Ma},
    title = {GitHub Actions secrets need to be explicitly declared},
    year = {2024},
    month = {01},
    day = {11},
    howpublished = {\url{https://ericmjl.github.io}},
    journal = {Eric J. Ma's Blog},
    url = {https://ericmjl.github.io/blog/2024/1/11/github-actions-secrets-need-to-be-explicitly-declared},
}

I send out a newsletter with tips and tools for data scientists. Come check it out at Substack.

# TODO(eric): learn how to learn anything. feb 2027.

If you would like to sponsor the coffee that goes into making my posts, please consider GitHub Sponsors!

Eric J Ma's Website