Required Terms
What service(s) is this request for?
Heroku dynos (fir)
Tell us about what you're trying to solve. What challenges are you facing?
Background
Many applications use private registries and/or repositories to store things like gems, node modules, etc. These packages in private registries generally require some sort of authentication secret, ie NPM_TOKEN or BUNDLE__GITLAB_COM token in order to install dependencies during the build pipeline.
Expectation
For builds, some private tokens are needed, ie NPM_TOKEN. Only these tokens should be shared with the build pipeline. Other variables, such as application API keys and database passwords, etc. should remain private to the production environment.
In private spaces, such as with Fir, we expect that our applications secret credentials that are not needed for a build do not leave the private space environment, and should not be exposed to the common runtime which is less secure.
We also expect that we should not commit any secrets to our git repository, ie NPM_TOKEN. This is a major security risk and a maintenance burden.
Current state
In Fir, it is possible to pass ALL config vars (secrets) to a build pipeline. However, this limitation exposes all of our config secrets outside of our environment to the common runtime.
Wishlist
Ideally we would like to be able to configure build time specific secrets (NPM_TOKEN, etc.) and pass ONLY those secrets to the Fir build process. That way secrets do NOT get exposed to the common runtime and we can keep important secrets not necessary for the build.
Required Terms
What service(s) is this request for?
Heroku dynos (fir)
Tell us about what you're trying to solve. What challenges are you facing?
Background
Many applications use private registries and/or repositories to store things like gems, node modules, etc. These packages in private registries generally require some sort of authentication secret, ie
NPM_TOKENorBUNDLE__GITLAB_COMtoken in order to install dependencies during the build pipeline.Expectation
For builds, some private tokens are needed, ie
NPM_TOKEN. Only these tokens should be shared with the build pipeline. Other variables, such as application API keys and database passwords, etc. should remain private to the production environment.In private spaces, such as with Fir, we expect that our applications secret credentials that are not needed for a build do not leave the private space environment, and should not be exposed to the common runtime which is less secure.
We also expect that we should not commit any secrets to our git repository, ie
NPM_TOKEN. This is a major security risk and a maintenance burden.Current state
In Fir, it is possible to pass ALL config vars (secrets) to a build pipeline. However, this limitation exposes all of our config secrets outside of our environment to the common runtime.
Wishlist
Ideally we would like to be able to configure build time specific secrets (
NPM_TOKEN, etc.) and pass ONLY those secrets to the Fir build process. That way secrets do NOT get exposed to the common runtime and we can keep important secrets not necessary for the build.