GitHub Codespace secrets when using VSCode devcontainers locally

Question

I am using a GCP service account file as a GitHub Codespaces secret, and I am able to access it from the Codespace container, as explained here.

Now, I want to also support developing locally without GitHub Codespaces but still use VSCode devcontainers.

I also hold the service account file on my local filesystem, but outside of the git repo (for obvious reasons). How should I reference it?

Answer 1

You can use the mounts property in devcontainer.json. Codespaces ignores bind mounts (more info can be found in the documentation) so you should be able to mount the file from your local filesystem without affecting how your Codespaces are built/ run.

Answer 2

Update

I have release an extension on the marketplace to solve this usecase: https://marketplace.visualstudio.com/items?itemName=pomdtr.secrets

It stores the secrets in the user keychain. Since it is a web extension, it runs on the client and also works with devcontainers.

Previous Answer

You can use the terminal.integrated.env.linux to pass the secret in your settings.json file.

You can disable settings sync using the settingsSync.ignoredSettings array:

{
  "terminal.integrated.env.linux": {
    "GITHUB_TOKEN": "<your-token>"
  },
  "settingsSync.ignoredSettings": [
    "terminal.integrated.env.linux"
  ]
}