To build a .NET application while securely handling a sensitive enterprise license on a GitHub- hosted Ubuntu runner, you should store the Base64-encoded license as a GitHub Repository Secret.
Key Security Considerations
Ephemeral Runners: GitHub-hosted runners are wiped after every job, meaning the decoded license file is automatically deleted.
Log Redaction: GitHub attempts to redact any output that matches your secret value, but manual transformations (like decoding) should still be handled carefully.
No Artifacts: Avoid using upload-artifact for any directories containing the decoded license, as artifacts can be downloaded by anyone with repository access
1. Store the License as a Secret
First, encode your license file to Base64 locally to ensure it is stored as a single string without formatting issues:
# On your local machine (Linux/macOS)
cat license.lic | base64 -w 0 > license_base64.txt
Then, add this string to your repository by navigating to Settings > Secrets and variables > Actions > New repository secret. Name it ENTERPRISE_LICENSE_BASE64.
2. Configure the GitHub Actions Workflow
Create a .yml file in .github/workflows/ that decodes the secret into a temporary file on the Ubuntu runner. GitHub automatically masks the secret value in logs, ensuring it remains private.
name: Build .NET App with License
on:
push:
branches: [ "main" ]
jobs:
build:
runs-on: ubuntu-latest # Use GitHub-hosted Ubuntu runner
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
dotnet-version: '8.0.x' # Specify your version
- name: Decode License
shell: bash
run: |
# Decode the secret into a file for the build process
echo "${{ secrets.ENTERPRISE_LICENSE_BASE64 }}" | base64 --
decode > ./license.lic
# The runner is ephemeral; the file is destroyed when the job ends.
- name: Restore dependencies
run: dotnet restore
- name: Build Application
# Pass the license path if your build process requires it
run: dotnet build --configuration Release --no-restore /p:LicensePath=./license.lic
- name: Secure Cleanup (Optional)
if: always()
run: rm -f ./license.lic
Reference:
https://docs.github.com/actions/security-guides/using-secrets-in-github-actions