audit-labs/gh-attest

 1// Secrets are set with `wrangler secret put`, not declared in
 2// wrangler.jsonc, so `wrangler types` can only discover their names from a
 3// local `.dev.vars` — which is gitignored and therefore absent in CI.
 4// Declaring them here merges with the generated `Env` interface, so the
 5// contract is explicit in source and type checking behaves the same on a
 6// developer machine and in a clean clone.
 7//
 8// Keep in sync with `.dev.vars.example` and the secrets set on the Worker.
 9interface Env {
10  /** GitHub App ID, for minting the App JWT. */
11  GITHUB_APP_ID: string;
12  /** GitHub App private key (PEM). PKCS#1 or PKCS#8 both accepted. */
13  GITHUB_APP_PRIVATE_KEY: string;
14  /** Shared secret used to verify inbound webhook signatures. */
15  GITHUB_WEBHOOK_SECRET: string;
16  /** OAuth client credentials for dashboard sign-in. */
17  GITHUB_APP_CLIENT_ID: string;
18  GITHUB_APP_CLIENT_SECRET: string;
19  /** HMAC key for signing session cookies. */
20  SESSION_SECRET: string;
21  /** Bearer token guarding the /admin/* routes. */
22  ADMIN_TOKEN: string;
23}