GitHub Repo Configuration

This repository is configured with the following secrets and environment variables which are required for some GitHub Action workflows as documented below.

Secrets

Secret Name	Description
API_TOKEN_GITHUB	GitHub API token configured with repo permissions. Used by copy_file_to_another_repo_action when deploying the frontend.
GOOGLE_DRIVE_API_KEY	Google Drive API key. Used by GitHub Actions when running backend & desktop tool tests, and built into the desktop tool binary.
KEYCHAIN_PASSWORD	Password attached to the temporary keychain created in Github Actions workflow for building the desktop tool, in the macOS signing steps. Set to a random string.
MACOS_NOTARY_ISSUER_ID	Issuer ID for App Store Connect API key used in desktop tool build GitHub Actions for macOS notarisation. A paid Apple developer account is required. Get the issuer ID from here.
MACOS_NOTARY_KEY_BASE64	base64 representation of App Store Connect API key used in desktop tool build GitHub Actions for macOS notarisation. A paid Apple developer account is required. Create an API key here and export the key as .p8, then copy the base64 representation with base64 -i AuthKey_AAABBBCCC.p8 | pbcopy.
MACOS_NOTARY_KEY_ID	ID of App Store Connect API key used in desktop tool build GitHub Actions for macOS notarisation. A paid Apple developer account is required. Get the key ID from here after generating your key.
MACOS_NOTARY_PROFILE_NAME	Profile used to temporarily store credentials with notarytool in Github Actions workflow for building the desktop tool, in the macOS signing steps. This value seems to be arbitrary.
MACOS_SIGN_CERTIFICATE_BASE64	base64 representation of certificate from Apple developer account. A paid Apple developer account is required. Follow this guide to export the certificate as .p12, then copy the base64 representation with base64 -i BUILD_CERTIFICATE.p12 | pbcopy.
MACOS_SIGN_CERTIFICATE_PASSWORD	Password for certificate from Apple developer account. A paid Apple developer account is required. This password is set when exporting the certificate as .p12 from KeyChain Access.
MACOS_SIGN_IDENTITY	Apple signing identity for signing macOS desktop tool binaries. A paid Apple developer account is required. Find your signing identity by running security find-identity on a macOS system and extracting the identity. The result of security find-identity is of the form 1) <signing identity> "<description>"
MOXFIELD_SECRET	User agent authentication for interactions with Moxfield's API. (MPC Autofill's MTG integration uses their API to read decklist data.)
NEXT_PUBLIC_GA_MEASUREMENT_ID	Your Google Analytics measurement id. Used by the nextjs-google-analytics package when deploying the frontend.
NEXT_PUBLIC_IMAGE_BUCKET_URL	Public URL for CloudFlare R2 bucket hosting card image thumbnails. Used by frontend when renderin Default value is https://img.mpcautofill.com.
NEXT_PUBLIC_IMAGE_WORKER_URL	Public URL for CloudFlare Worker managing card image thumbnails. Default value is https://cdn.mpcautofill.com.
SENTRY_AUTH_TOKEN	The SENTRY_AUTH_TOKEN variable is picked up by the Sentry Build Plugin. See Sentry docs for further information.
SIGNPATH_API_TOKEN	API key provided by SignPath. Used to sign Windows executables for the desktop tool via SignPath's GitHub Actions integration.