{"repo":"step-security/wait-for-secrets","free":true,"listed":false,"github":"https://github.com/step-security/wait-for-secrets","clone":"git clone https://github.com/step-security/wait-for-secrets.git","description":"Publish from GitHub Actions using multi-factor authentication","language":"TypeScript","stars":299,"topics":["action","actions","github-actions","mfa","security"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"--- Wait-for-secrets GitHub Action waits for the developer to enter secrets during a workflow run. Developers can enter secrets using a web browser and use them in the workflow. Why? - MFA To enable using multi-factor authentication (MFA)/ one-time password (OTPs) for a release workflow, e.g., use OTP to publish to the npm registry. - Separation of duties Even if someone has write access to the repository, they do not get access to the deployment secrets. - More control You have more control over when secrets get used in your workflows. With wait-for-secrets, there is manual human interaction needed for publishing. - Less management overhead You can use your existing account for deployment. This removes the need to manage a separate set of deployment credentials. How? 1. Add the wait-for-secrets GitHub Action to your workflow and specify the secrets you need. 2. The Action will print a URL in the build log every 10 seconds and wait for you to enter the secrets 3. Click on the URL and enter the secrets that the workflow needs. 4. The Action will get the secrets you entered in the browser and continue execution. 5. Use the retrieved secrets in future steps. Demo workflow Use this workflow to see a quick demo of wait-for-secrets with a dummy secret. Publish to NPM registry using one-time password (OTP) Use this workflow to publish to the npm registry using a one-time password. Prerequisites: 1. Setup two-factor authentication for your account. 2. Require two-factor authenticatio","default_branch":null,"files":null,"tree":[],"storefront":"/r/step-security","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/step-security/wait-for-secrets/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}