Environment Placeholders in GitHub Integration Cause Build Failures

We’re attempting to do an initial configuration of our Backstage deployment using the Docker method and including environment placeholders in the app-config.yaml for any sensitive config values.

We’re running into an issue specifically around using the GitHub app created by the backstage CLI, when we replace the values of things like clientSecret clientId and privateKey with the env nomenclature ${GitHubAppPrivateKey} we end up in a config load failure during the following build command:

yarn --cwd packages/backend backstage-cli backend:bundle --build-dependencies

Our app-config.yaml for integrations looks like the following

integrations:
  github:
    - host: github.com
      apps:
        - appId: 111222 #redacted
          webhookUrl: https://smee.io/redactedUrlHere #redacted
          clientId: ${AUTH_GITHUB_CLIENT_ID}
          clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
          webhookSecret: ${WEBHOOK_SECRET}
          privateKey: ${PRIVATE_KEY}

The documentation shows this as a $include with a link to the file, we run into the same error if we $include or put it directly in app-config.

This configuration produces the following errors:

Config should have required property 'clientId' { missingProperty=clientId } at /integrations/github/0/apps/0
Config should have required property 'clientSecret' { missingProperty=clientSecret } at /integrations/github/0/apps/0
Config should have required property 'privateKey' { missingProperty=privateKey } at /integrations/github/0/apps/0
Config should have required property 'webhookSecret' { missingProperty=webhookSecret } at /integrations/github/0/apps/0

If we hardcode the value instead of using the ${ENV_VAR} placeholder, this build command does not fail.

Expected Behavior

We shouldn’t be failing the schema validation when using env var substitutes.

Current Behavior

Schema validation for the GitHub integration is failing, even though the properties are there.

Steps to Reproduce

Use the following in your app-config.yaml:

integrations:
  github:
    - host: github.com
      apps:
        - appId: 111222 #redacted
          webhookUrl: https://smee.io/redactedUrlHere #redacted
          clientId: ${AUTH_GITHUB_CLIENT_ID}
          clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
          webhookSecret: ${WEBHOOK_SECRET}
          privateKey: ${PRIVATE_KEY}

Attempt the build the Docker image docker build .

Your Environment

• NodeJS Version (v12): v12.22.1
• Operating System and Version (e.g. Ubuntu 14.04): Attempted in Win 10, Ubuntu 20.04 (WSL), and in Ubuntu 18.04

[yafanasiev]

I hit the same issue. When using the multi-stage container build yarn --cwd packages/backend backstage-cli backend:bundle --build-dependencies gets executed, which will not tolerate missing environment variables. This was fixed in a similar issue for app:build command, I assume it should be added for backend:bundle as well.

[jamesrenaud]

This may have been a user error in where we were making the environment variables available within the Dockerfile so the variables were indeed undefined at that point in the process.

Seems we’re a bit further along in getting this working, once I’ve got the service stood up again and I’ve confirmed it’s working I’ll post a full follow on in case anyone else runs into this issue.