Gitignore在GitHub代码中是否可以看到除我以外的任何人都可以看到的d` .env`文件吗?

发布于 2025-02-13 18:12:02 字数 647 浏览 0 评论 0原文

背景

github允许您存储加密的秘密设置>代码> codespaces Secrets )对于安全性,存储的秘密一旦存储就永远不会看到它们。

但是,在黑客攻击新事物时,我发现能够偶尔看到我的秘密和其他环境变量很有用。通常,当在本地项目上黑客攻击时,我将将我的秘密存储在.env文件中,该文件通过在我的.gitignore文件中列出来将其拒之门。

我想对github codespaces做同样的问题

:将gitignore'd .env文件存储在我的codespace中,仅对我可见。

但是,随着github代码生活在云中,尚不清楚此.env文件是否会以某种方式可见。

问题

如果我 gitignore a .env(或我的github codespase中的任何其他文件)是否会通过代码台面向其他文件可见吗?

Background

GitHub allows you to store Encrypted Secrets (Settings > Codespaces > Codespaces secrets), which is an amazing feature. For security, secrets stored this way are never visible to you once they are stored.

However, while hacking on something new, I find that it’s useful to be able to see my secrets and other environment variables occasionally. Typically, when hacking on a local project, I’ll store my secrets in a .env file, which is kept out of source control by listing it in my .gitignore file.

Issue

I’d like to do the same with GitHub Codespaces: store a gitignore’d .env file in my Codespace that is visible only to me.

However, with GitHub Codespaces living in the cloud, it is unclear whether this .env file would be somehow visible to others.

Question

If I gitignore a .env (or any other) file in my GitHub Codespace, is that file going to be somehow visible via the Codespace to others?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

一萌ing 2025-02-20 18:12:02

我收到

代码空间文件系统对其他任何人都看不到,包括codesspace与之相关联的org管理员。因此,只要您gitignore the .env文件,除了托管秘密之外,您都可以使用它。

这是我想要的答案。


除了有用的情况下,他还指出了线程:

也就是说,您还可以使用“ codeps:管理用户秘密”命令,直接从VS代码查看/添加/添加/编辑/删除秘密。因此,这可能提供了一种轻松管理编辑器的秘密的选择?

I received this answer on Twitter from GitHub employee Jonathan Carter (@LostInTangent) yesterday:

The Codespaces file system isn’t visible to anyone else, including org admins for the repo the Codespace is associated with. So as long as you gitignore the .env file, you’re totally fine to use that, in addition to managed secrets.

This is the answer I was looking for.


As a helpful aside, he additionally notes in-thread:

That said, you can also use the “Codespaces: Manage User Secrets” command, to view/add/edit/delete secrets directly from VS Code. So that might provide another option for easily managing secrets from the editor?

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文