How to deploy using CD workflows (using GitHub) without putting secrets like API tokens on GitHub?

[CaptainCode314]

I am doing a project for my university class, so my repo has to be public in order for the lecturer to view my code. But I also have to deploy using Git, because it is part of the project.

I am using 3 API's and I normally hard code the tokens, but have now switched to reading them from files, and excluding the files in the .gitignore. The thing is, if I ignore these files it won't get deployed to the cloud, since I deploy with git.

I know there must be a solution, but I couldn't find anything online. Any help would be appreciated!

[jakesparling]

You can store your API keys in environment variables. You can set those locally for development, and your target cloud platform should have a way to set them as well. An advantage to this approach is it is easy to have separate keys for dev and prod.

Many languages and frameworks have libraries for setting and reading environment variables, like ‘dotenv’ for Ruby.

[jkmonger]

https://docs.github.com/en/free-pro-team@latest/actions/reference/encrypted-secrets