0

I created a configuration file in my Kohana project that stores the OAuth access tokens and secret keys for an API in application/config.

I now want to push my code to GitHub but I don't want to expose tokens/keys on GitHub. I know with CodeIgniter, all I need to do is put these sensitive files in the application/config/development directory, set my .gitignore file to ignore the development directory (*/config/development), push my code to the remote, and continue working with my config details in the development directory.

Is there something similar or specific in working on Kohana project? Should I just create a rule in .gitignore file that ignores the application/config?

random
  • 9,774
  • 10
  • 66
  • 83
Anthony
  • 3,990
  • 23
  • 68
  • 94

1 Answers1

2

You can go about this in at least two ways:

  • track a sample, munged version of the configuration file, ignoring the actual version
  • commit a munged version of the configuration file and then ignore it from future tracking

Track munged sample version

Put the configuration files explicitly in .gitignore (no wildcards, e.g. /config/database.php) and create a copy that has the same contents, except the keys and other sensitive data is replaced with NULLs or XXXs and save that into a file like /config/database-sample.php and track, commit and push that.

Maybe even using symbolic links between the two.

Ignore with munging

Or you can commit a munged version, push that, then drop it from the index with --assume-unchanged

git update-index --assume-unchanged <file>

Any changes now to the file will not be seen by Git and you can then edit back in the keys.

In both methods you keep the structure of the project files (roughly) available for others to clone and edit as necessary for their local or development repo without having to guess that there are holes to fill.

Community
  • 1
  • 1
random
  • 9,774
  • 10
  • 66
  • 83
  • +1 Yes, thank you very much. I loved the first option and will use this. I need to reread the second option and understand it better. Thank you very much! – Anthony Sep 18 '13 at 04:50
  • 1
    Second option you commit it first time with fake values, and after you have that version, you tell Git to then ignore any more changes on it. That means whatever future edits you do will not be seen by Git. Is that any clearer? – random Sep 18 '13 at 04:54