Previous Lecture lect12 Next Lecture

lect12, Mon 02/24

Prepare Inter-Team Eval, Secrets, (Patterns, Code Smells, UX Principles)

Announcements

Inter-Team Evaluation

To ensure your API keys are not exposed in a public GitHub repository, follow these best practices:

  1. Use a .gitignore File
    • Store your API keys in a separate configuration file (e.g., .env, config.json).
    • Add that file to .gitignore before committing to GitHub.
  2. Use Environment Variables
    • Store API keys in environment variables instead of hardcoding them in your code.

    • Access them in your code like this:

      Python:

      import os

api_key = os.getenv("API_KEY")

       

      Node.js (JavaScript/TypeScript):

      const apiKey = process.env.API_KEY;

       

  3. Use GitHub Secrets for Actions
    • If you’re using GitHub Actions, store API keys as GitHub Secrets and access them within workflows.
  4. Scan for Secrets Before Committing
  5. Remove Secrets from Git History
    • If you’ve already committed a secret, do not just delete it — it remains in the Git history. Instead:
      • Use git filter-repo (recommended over git rebase) to remove it from history: 
        git filter-repo --path <file-with-secret> --invert-paths
      • Force-push to overwrite history (be cautious): 
        git push origin --force --all
      • If the secret is compromised, revoke and regenerate it immediately.
  6. Use a Secret Management Service

By following these practices, you can safely make your GitHub repo public without exposing sensitive API keys.

SW Design Patterns, AntiPatterns, Code Smells

UX Design

Today: Work in Breakout Groups

In general: