Adding/overwriting configuration files (secrets, gitignored, not in repository)

Question & Answer
1

Hi, I have a problem with configuring new builds for Android.
I have confidential info - api endpoints, tokens etc. that I do not want to include in my github repo. The problem is that I am not able to add/overrwrite files to include credentials in build. The only solution I found is to create script to do that stuff, but I think this solution is not flexible and could be little bit problematic in case of changing for example api endpoint. Do you maybe have another solution for my problem?
Thanks in advance!

1 Like
2

Hi @dawidfiruzek :wave: :slight_smile:

In general the solutions (might be others too, if anyone have any additional note just let us know!):

  1. Use a secondary repository to store your secrets in, and git clone that with a Script step for example (if you’d want to do this please make sure that the same SSH key can be used for both repos!)
  2. Use App Env Vars or Secret Env Vars on bitrise.io - you can find these in the Workflow Editor (Workflow tab of your app on bitrise.io). The variables you define here are regular environment variables, so you can use them any way you like, e.g. with a Script step, writing into a file.
  3. Use the Generic File Storage feature of bitrise.io, upload your file(s) and download it using the File Downloader or ZIP resource archive downloader step.

These are just the highlights of the main solutions of course, there are other possible ways if you’re more adventurous, e.g. store the file encrypted in your repository, store the encryption key in an App Env Var or Secret Env Var on bitrise.io and decrypt the file during the build.

If you have any questions, just let us know!