How to hide hiding secret keys in commits to bitbucket private repo?
<p>I'm using python. Currently, I'm doing this. I have a file named <code>keys.py</code> where I store in my secret keys such as AWS_SECRET and etc.</p>

<p>Inside my <code>.gitignore</code> I have keys.py so that it doesn't get committed to bitbucket.</p>

<p>My <code>keys.py</code> looks like this.</p>

<pre><code>#!/usr/bin/env python

AWS_KEY = "1231231231"
AWS_SECRET = "23123123123"
PHONE_NUMBER = "12312312312"
</code></pre>

<p>Inside the python file that needs the keys, I do the following.</p>

<pre><code>import keys

print keys.AWS_KEY
</code></pre>

<p>The problem I'm having now is that now that bitbucket supports pipelines, I am able to do the testing and stuff and deploy to server straight. However, since <code>keys.py</code> isn't in my repo, bitbucket fails to test the code.</p>

<p>There is environment variables settings in bitbucket. But that will require me to change my codebase to accept environment variables.</p>

<p>What should I do to use bitbucket pipelines? Should I change my code to use environment variables? Is there any better approaches?</p>

<p>Thanks all.</p>

<p>You should use environment variables. That is the norm. You will have to adapt your code for this change. </p>

<p>A simple fix may be to have your <code>keys.py</code> file look for the environment variables. You can retrieve environment variables as follows: <code>os.environ.get("VARIABLE_NAME")</code></p>

<p>As an aside: depending on your use case, you may want to write your tests such that they don't depend on <em>actually</em> calling the services; such as by writing mock classes specifically for testing. This is normal practice, and it will speed up your tests as well. Of course, that's not always easy or practical. So maybe look into mocks and other testing techniques.</p>

python git