Merge pull request #4107 from backstage/jhaals/credentials-suffix

cli: Append '-credentials' to file generated by create-github-app

.changeset/loud-kids-dance.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Append `-credentials.yaml` to credentials file generated by `backstage-cli create-github-app` and display warning about sensitive contents.

.changeset/spoon-fork.md

@@ -0,0 +1,12 @@
+---
+'@backstage/create-app': patch
+---
+
+Add `*-credentials.yaml` to gitignore to prevent accidental commits of sensitive credential information.
+
+To apply this change to an existing installation, add these lines to your `.gitignore`
+
+```gitignore
+# Sensitive credentials
+*-credentials.yaml
+```

.gitignore

@@ -130,3 +130,6 @@ site
 
 # Local configuration files
 *.local.yaml
+
+# Sensitive credentials
+*-credentials.yaml

packages/cli/src/commands/create-github-app/index.ts

@@ -26,9 +26,14 @@ import { GithubCreateAppServer } from './GithubCreateAppServer';
 export default async (org: string) => {
   const { slug, name, ...config } = await GithubCreateAppServer.run({ org });
 
-  const fileName = `github-app-${slug}.yaml`;
+  const fileName = `github-app-${slug}-credentials.yaml`;
   const content = `# Name: ${name}\n${stringifyYaml(config)}`;
   await fs.writeFile(paths.resolveTargetRoot(fileName), content);
   console.log(`GitHub App configuration written to ${chalk.cyan(fileName)}`);
+  console.log(
+    chalk.yellow(
+      'This file contains sensitive credentials, it should not be committed to version control and handled with care!',
+    ),
+  );
   // TODO: log instructions on how to use the newly created app configuration.
 };

packages/create-app/templates/default-app/.gitignore.hbs

@@ -30,4 +30,7 @@ dist-types
 site
 
 # Local configuration files
-*.local.yaml
+*.local.yaml
+
+# Sensitive credentials
+*-credentials.yaml