I have a GitHub workflow that performs Terraform plan and apply commands.

I want users to review the generated plan before the apply command. For the apply job, I use an environment where reviews are enabled. However, I don’t want the plan step to require approval, so I removed the environment from that job.

In the apply job, I access secrets specified in the GitHub environment for logging into Azure with federated credentials. These secrets include AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, and AZURE_CLIENT_ID, which I reference using ${{ secrets.AZURE_CLIENT_ID }}.

I want to use these same environment secrets in the plan job without setting the environment, as this would require approval.

Currently, this is solved by duplicating the secrets that I defined in the GitHub environment as repository secrets, which I find undesirable.

I considered fetching these secrets via the GitHub API using this endpoint, but it only returns some properties, not the actual (albeit encrypted) values.

Do know that my idea is not to use these secrets outside the workflow, just use them inside the workflow as GitHub secrets’ intended use. But I want to avoid duplicating these secrets and the duplicate approval.

I also have had the idea of duplicating the environment into a dev-tfplan and dev, and then performing some auto approval on the dev-tfplan (see this action for example). But was curious whether there’s a better approach. Or an idea that I didn’t think of.