In the last article I introduced age and a working setup for macOS. Now let's look at Github actions integration

TL/DR

In a nutshell: create an age key just for GitHub actions, commit it to secrets, add the public key to recipients.txt and add it to your github job.

Credential stealing is rampant, so some diligence in guarding API keys, passphrases and secrets is warranted.

Stop wondering if it could happen to you, but prepare for when it might happen. Here is one arrow in your defense portfolio.

Limit the blast radius

When an attacker sneaks by your 2FA using e.g a supply chain attack your next line of defense is "How much can they see?"

• For starters no key (other than public ones), token or credential shall live on disk unencrypted.
• Loaded evn variables should be limited to their projects, when in ~/Code/someproject there must not be any env variable from ~/Code/otherproject be loaded.
• The day-2-day use must be easy and convenient

Three components

To make this work we need three components:

• macOS keychain: holds the AGE key(s), (Other operating systems is another story for another time).
• age "Actually good encryption": to encrypt your secrets and .env variables.
• direnv: Loads and unloads environment variables depending on the current directory.

For my development setup I typically rely on Development Containers which works very UI centric. Your Ide discovers the .devcontainer folder and boots an edit container and starts whatever you have defined in your docker-compose.yml file. This is great for sharing, I wrote about it, read for a refresher.

In a terminal centric world this is a heavy approach and I want options

Multiplex your terminal

My goal: with a single script start quarkus dev, twice npm run dev and a database (Apache CouchDB, glad you asked). They all need to run in the foreground, so I can keep an eye on them. This precludes simply using & to run them in the background.

Enter tmux. The wiki describes it: "tmux is a terminal multiplexer. It lets you switch easily between several programs in one terminal, detach them (they keep running in the background) and reattach them to a different terminal." Claude described it like this (might contain emscripten):

Code pedigree is more important than ever with the ever increasing rate of supply chain attacks. Setting up code signing are a few steps, recorded here for reference.

Choice of key formats

While you could pick an ssh or x509 key, I shall stick to gpg and the Ed25519 algorythm.

Act 1 - get macOS ready

When you followed earlier advice you are good to go. If not, install Homebrew and dependencies

brew install gh gpg pinentry-mac

# setup pinentry
mkdir -p ~/.gnupg
chmod 700 ~/.gnupg
echo "pinentry-program $(brew --prefix)/bin/pinentry-mac" >> ~/.gnupg/gpg-agent.conf
gpgconf --kill gpg-agent

Act 2 - create the key

This creates a signing key that lasts for 2 years. Make sure to get the eMail right. After creation we extract the key id.

gpg --batch --quick-generate-key "John Doe <john.doe@example.com>" ed25519 sign
TARGET_EMAIL="john.doe@example.com"
GPG_KEY_ID=$(gpg --list-secret-keys --with-colons "$TARGET_EMAIL" 2>/dev/null \
             | awk -F: '$1=="sec" {print $5; exit}')
echo Your key id is $GPG_KEY_ID

You also can do that manually running gpg --list-secret-keys --keyid-format=long and look for the string after the / in the line starting with sec.

Act 3 - configure your local git

Make sure to get the eMail right

git config --global user.name "John Doe"
git config --global user.email "$TARGET_EMAIL"
git config --global user.signingkey "$GPG_KEY_ID"
git config --global commit.gpgsign true
git config --global tag.gpgsign true
git config --global pull.rebase true

Act 4 - Let github know

Display the public key:

gpg --armor --export $GPG_KEY_ID

Go to your Github key settings, click on "New GPG key" and paste it

Act 5 - overwrite for individual repos (optional)

git config user.name "John Doe"
git config user.email "$TARGET_EMAIL"
git config user.signingkey "$GPG_KEY_ID"
git config commit.gpgsign true
git config tag.gpgsign true
git config pull.rebase true

For adventurous souls there is a setup script available to automate this. Use at your own risk.

As usual YMMV