GitHub Repo Configuration

This repository is configured with the following secrets and environment variables which are required for some GitHub Action workflows as documented below.

Secrets

Secret Name	Description
API_TOKEN_GITHUB	GitHub API token configured with repo permissions. Used by copy_file_to_another_repo_action when deploying the frontend.
CLOUDFLARE_API_TOKEN	Cloudflare API token. Used for continuous deployment to Cloudflare workers through GitHub Actions.
CLOUDFLARE_ACCOUNT_ID	Cloudflare account ID. Used for continuous deployment to Cloudflare workers through GitHub Actions.
GOOGLE_DRIVE_API_KEY	Google Drive API key. Used by GitHub Actions when running backend & desktop tool tests, and built into the desktop tool binary.
IMAGE_CDN_BUCKET_DOMAIN	Public domain for CloudFlare R2 bucket hosting card image thumbnails. Used by frontend when loading card images. Not https:// prefixed. Default value is img.mpcautofill.com.
IMAGE_CDN_GOOGLE_CLIENT_ID	Google client ID used by image CDN. Looks like 1234567890.apps.googleusercontent.com. Refer to this article for further information.
IMAGE_CDN_GOOGLE_CLIENT_SECRET	Google client secret used by image CDN. Refer to this article for further information.
IMAGE_CDN_GOOGLE_REFRESH_TOKEN	Google refresh token used by image CDN. Prefixed with 1/. Refer to this article for further information.
IMAGE_CDN_WORKER_DOMAIN	Public domain for CloudFlare Worker managing card image thumbnails. Used by frontend when loading card images and in image CDN worker configuration. Not https:// prefixed. Default value is cdn.mpcautofill.com.
KEYCHAIN_PASSWORD	Password attached to the temporary keychain created in the Github Actions workflow for building the desktop tool, in the macOS signing steps. Set to a random string.
MACOS_NOTARY_ISSUER_ID	Issuer ID for App Store Connect API key used in the GitHub Actions workflow for building the desktop tool, in the macOS signing steps. A paid Apple developer account is required. Get the issuer ID from here.
MACOS_NOTARY_KEY_BASE64	base64 representation of App Store Connect API key used in the GitHub Actions workflow for building the desktop tool, in the macOS signing steps. A paid Apple developer account is required. Create an API key here and export the key as .p8, then copy the base64 representation with base64 -i AuthKey_AAABBBCCC.p8 | pbcopy.
MACOS_NOTARY_KEY_ID	ID of App Store Connect API key used in the GitHub Actions workflow for building the desktop tool, in the macOS signing steps. A paid Apple developer account is required. Get the key ID from here after generating your key.
MACOS_NOTARY_PROFILE_NAME	Profile used to temporarily store credentials with notarytool in Github Actions workflow for building the desktop tool, in the macOS signing steps. This value seems to be arbitrary.
MACOS_SIGN_CERTIFICATE_BASE64	base64 representation of certificate from Apple developer account. A paid Apple developer account is required. Follow this guide to export the certificate as .p12, then copy the base64 representation with base64 -i BUILD_CERTIFICATE.p12 | pbcopy.
MACOS_SIGN_CERTIFICATE_PASSWORD	Password for certificate from Apple developer account. A paid Apple developer account is required. This password is set when exporting the certificate as .p12 from KeyChain Access.
MACOS_SIGN_IDENTITY	Apple signing identity for signing macOS desktop tool binaries. A paid Apple developer account is required. Find your signing identity by running security find-identity on a macOS system and extracting the identity. The result of security find-identity is of the form 1) <signing identity> "<description>"
MOXFIELD_SECRET	User agent authentication for interactions with Moxfield's API. (MPC Autofill's MTG integration uses their API to read decklist data.)
NEXT_PUBLIC_GA_MEASUREMENT_ID	Your Google Analytics measurement id. Used by the nextjs-google-analytics package when deploying the frontend.
NEXT_PUBLIC_GOOGLE_DRIVE_APP_ID	Your Google Drive app ID. Used by the frontend's Google Picker API integration for client-side Google Drive integration.
NEXT_PUBLIC_GOOGLE_DRIVE_CLIENT_ID	Your Google Drive client ID. Used by the frontend's Google Picker API integration for client-side Google Drive integration.
SENTRY_AUTH_TOKEN	The SENTRY_AUTH_TOKEN variable is picked up by the Sentry Build Plugin. See Sentry docs for further information.
SIGNPATH_API_TOKEN	API key provided by SignPath. Used to sign Windows executables for the desktop tool via SignPath's GitHub Actions integration.