GitHub Secrets and Variables

Configure these values in GitHub under Settings > Secrets and variables > Actions.

warning

Never commit secret values, service account keys, OAuth credentials, or runtime env files to either repository.

Backend repository

Repository: CATALOG-Historic-Records/orphaned-wells-ui-server

Name	Required for	Notes
PROJECT_ID	GKE deployment, tests, infrastructure automation	Google Cloud project ID.
DOCKERHUB_USERNAME	GKE deployment	Docker Hub account used to push and pull backend images.
DOCKERHUB_ACCESS_TOKEN	GKE deployment	Docker Hub token used by CI and Kubernetes image pull secret creation.
CREDS_JSON	Backend runtime files, older gcloud operations	Google authorized-user credentials JSON. Treat as highly sensitive.
SERVICE_KEY_JSON	GKE deployment and backend runtime files	Google Cloud service account key JSON. The workflow uses it for GKE credentials and runtime file secrets.
K8S_DEPLOY_TARGETS	GKE deployment	JSON from terraform output -json kubernetes_deploy_targets | jq -c .. Includes Kubernetes hosts, static IP names, resource settings, and upload bucket names. Update it after Terraform changes deployment targets.
<COLLABORATOR>_ENV	GKE deployment	Runtime .env content for each dispatch-supported backend collaborator. The current dispatch workflow reads STAGING_ENV, CA_ENV, ISGS_ENV, NEWTS_ENV, OSAGE_ENV, and RRC_ENV.
REFRESH_TOKEN	Integration tests	Google OAuth refresh token used by automated tests when needed.

The runtime env secrets should contain backend runtime values such as database settings, storage settings, OAuth settings, and collaborator configuration. The GKE workflow overrides:

• ENVIRONMENT
• BACKEND_URL
• LOG_DIR
• LOCAL_STORAGE_ROOT
• LOCAL_STORAGE_URL_BASE
• STORAGE_BUCKET_NAME

Keep COLLABORATOR in the runtime secret if the backend uses collaborator-specific processors or configuration.

Backend repository variables

Use repository variables to control automatic GKE deploys:

Name	Purpose
ENABLE_GKE_DEPLOYMENTS	Enables automatic GKE deploys for all collaborator workflows that check this variable.
ENABLE_GKE_STAGING_DEPLOY	Enables automatic staging GKE deploys.
ENABLE_GKE_CA_DEPLOY	Enables automatic CA GKE deploys.
ENABLE_GKE_ISGS_DEPLOY	Enables automatic ISGS GKE deploys.
ENABLE_GKE_NEWTS_DEPLOY	Enables automatic NEWTS GKE deploys.
ENABLE_GKE_OSAGE_DEPLOY	Enables automatic OSAGE GKE deploys.

When adding a new collaborator, add the matching secret and variable only after the workflow is configured to read it. The reusable GKE dispatch workflow must include the collaborator in its DEPLOY_ENV options, accepted secrets, and runtime-env case mapping.

Legacy backend VM secrets

These are only needed for the legacy VM deployment path:

Name	Purpose
DEPLOY_TARGETS	JSON map of VM names and zones consumed by older VM deployment workflows.
SSH_USERNAME	SSH user for deployment commands against Compute Engine VMs.

Frontend repository

Repository: CATALOG-Historic-Records/orphaned-wells-ui

Name	Required for	Notes
GCLOUD_SERVICE_ACCOUNT_JSON	App Engine deployment	Google Cloud service account key JSON used by frontend deployment workflows.
GOOGLE_CLIENTID	Frontend build	Google OAuth client ID written to REACT_APP_GOOGLE_CLIENTID.
DEV_BACKEND_URL	Default/staging frontend deployment	Backend URL used by the main frontend deploy workflow.
<COLLABORATOR>_BACKEND_URL	Collaborator frontend deployments	Backend URL for a collaborator frontend, such as CA_BACKEND_URL, ISGS_BACKEND_URL, NEWTS_BACKEND_URL, or OSAGE_BACKEND_URL.

Backend URL values must not include a trailing slash.

Updating secrets

For command-line secret updates, first authenticate the GitHub CLI with an account that can edit repository Actions secrets:

gh auth login
gh auth status --hostname github.com

After Terraform changes backend deployment targets, run this from orphaned-wells-ui-server/deployment/terraform:

terraform workspace select ogrre
gh secret set K8S_DEPLOY_TARGETS \
  --repo CATALOG-Historic-Records/orphaned-wells-ui-server \
  --body "$(terraform output -json kubernetes_deploy_targets | jq -c .)"

For manual updates in GitHub:

1. Open the target repository on GitHub.
2. Go to Settings > Secrets and variables > Actions.
3. Select the secret or variable to create or update.
4. Save the new value.
5. Re-run the affected deployment workflow.