chore: move Algolia search keys to environment variables - #2312
Open
isaque-bock-azion wants to merge 1 commit into
Open
chore: move Algolia search keys to environment variables#2312isaque-bock-azion wants to merge 1 commit into
isaque-bock-azion wants to merge 1 commit into
Conversation
…bles Replace hardcoded Algolia app id and search-only api key with PUBLIC_ALGOLIA_APP_ID and PUBLIC_ALGOLIA_SEARCH_KEY read via import.meta.env, remove the unused ALGOLIA_ID/ALGOLIA_APIKEY exports from consts, document the variables in .env.example, and export them in the dev/stage/prod build workflows. Refs: MM-15902
isaque-bock-azion
force-pushed
the
chore/algolia-env-keys
branch
from
August 10, 2026 18:06
1c577b1 to
4bb33f7
Compare
Comment on lines
32
to
+35
| export NODE_OPTIONS="--max-old-space-size=8120" | ||
| export PUBLIC_GITHUB_TOKEN="${{ secrets.GH_PACKAGES_SECRET }}" | ||
| export PUBLIC_ALGOLIA_APP_ID="${{ secrets.PUBLIC_ALGOLIA_APP_ID }}" | ||
| export PUBLIC_ALGOLIA_SEARCH_KEY="${{ secrets.PUBLIC_ALGOLIA_SEARCH_KEY }}" |
Contributor
There was a problem hiding this comment.
Those exports are not the best way to do this. My suggestion is to use env property of the github actions.
Comment on lines
40
to
+43
| export NODE_OPTIONS="--max-old-space-size=8120" | ||
| export PUBLIC_GITHUB_TOKEN="${{ secrets.GH_PACKAGES_SECRET }}" | ||
| export PUBLIC_ALGOLIA_APP_ID="${{ secrets.PUBLIC_ALGOLIA_APP_ID }}" | ||
| export PUBLIC_ALGOLIA_SEARCH_KEY="${{ secrets.PUBLIC_ALGOLIA_SEARCH_KEY }}" |
Contributor
There was a problem hiding this comment.
Same about env vs exports
Comment on lines
32
to
+35
| export NODE_OPTIONS="--max-old-space-size=8120" | ||
| export PUBLIC_GITHUB_TOKEN="${{ secrets.GH_PACKAGES_SECRET }}" | ||
| export PUBLIC_ALGOLIA_APP_ID="${{ secrets.PUBLIC_ALGOLIA_APP_ID }}" | ||
| export PUBLIC_ALGOLIA_SEARCH_KEY="${{ secrets.PUBLIC_ALGOLIA_SEARCH_KEY }}" |
Contributor
There was a problem hiding this comment.
samo about env vs exports
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Moves the hardcoded Algolia DocSearch credentials out of source code into environment variables (
PUBLIC_ALGOLIA_APP_IDandPUBLIC_ALGOLIA_SEARCH_KEY), per MM-15902 (Fase 0 — Docs Modernização).BaseLayout.astro:AlgoliaDialognow reads the app id and search key fromimport.meta.envinstead of inline literalsALGOLIA_ID/ALGOLIA_APIKEYexports fromsrc/consts.tsand all fourenv/consts.*.tsvariants (nothing imported them).env.exampledocumenting the required variablesdev.yml/stage.yml/prod.ymlworkflows export both variables from GitHub secrets in the build stepAction required before merge
The repository secrets
PUBLIC_ALGOLIA_APP_IDandPUBLIC_ALGOLIA_SEARCH_KEYmust be registered in GitHub (Settings → Secrets → Actions), otherwise the search dialog will render without credentials on the next deploy.Validation
astro buildpasses locally (1494 pages) with the variables set via.envgrepconfirms zero hardcoded keys left insrc/,env/andcicd/maineither (pre-existingalgoliasearchESM interop issue in Vite dev, unrelated to this change)Notes
The key being moved is Algolia's public search-only key, so this is hygiene/config cleanup rather than a secret leak remediation. The
PUBLIC_prefix is required by Astro to expose the values to the client-side dialog.