How can provide credentials for an external service?

[jonnybbb]

Suppose I want to call an external service / API from the GitHub app. What is a secure way to configure those credentials if I do not want to store them insecurely in the repository? Basically I am looking for encrypted secrets that are available for GitHub Actions but for a GitHub app.

[gsmet]

I'm not sure I understand your use case:

1. do you want a way to pass common credentials to the GitHub App at startup?
2. or do you want a way to have credentials per repository that would be somehow stored as secrets on GitHub?

1/ is easy: you can use Quarkus' config framework to inject environment variables into config: https://quarkus.io/guides/config-reference .

2/ I don't think you have many options there. GitHub secrets are not available to GitHub Apps and there's no way to get the values from the API. The only option I see is to encrypt the secrets with GPG and host them in the repo.

Note that if GitHub Actions are more practical for you, we also have https://github.com/quarkiverse/quarkus-github-action .

[jonnybbb]

Thanks for the pointers, yeah, I think a GitHub action is more suitable for my use case.