I would like to create a GitHub workflow for running tests against a REST API. The API needs a key that is always tied to a user, there is no global "testing" key.
Is there a way for each contributor to store their API key in a way that GitHub Actions can access it? I understand there is GitHub Secrets, but these are at best defined at a repo-level. I have also seen that this option exists for Codespaces, but my organization is not using those.
I haven't seen this, since the GHA only has the person who triggered and commits context available.
For testing, it's better to have a user assigned to this purposes and then store its secrets in the repo/org level. Although if the REST API is the project itself, setting up the project (API), creating the test user (with pre-defined secrets) and testing with it should be part of the pipeline as possible.
As a last resource (wouldn't recommend, reconsider strategy), I'd go ahead and use a separate vault for secrets (like Hashicorp Vault), login with project credentials and based on an input or action actor, fetch per-user secrets.
