How can I get an R environment via Sys.getenv() with GitHub Actions using secrets?

Question

I would like to use Sys.getenv() to retrieve an environment variable.

Locally, I'm able to save a .Renviron file in my working directory that has the variables in it. These load perfectly fine and tests pass.

The repository is here for reference: https://github.com/Stoltzman-Consulting/githubActionsR

However, due to the fact there are secrets stored, I cannot upload this file into my repository. I have created secrets in the GitHub secrets section:

My tests are as follows:

test_that("multiplication works", {
  expect_equal(2 * 2, 4)
})

test_that("Environment variable exists", {
  expect_equal(Sys.getenv('MY_SECRET'), 'i_want_this')
})

test_that("Environment variable 2 exists", {
  expect_equal(Sys.getenv('MY_SECRET2'), 'i_want_this_2')
})

My GitHub Actions file is as follows:

# For help debugging build failures open an issue on the RStudio community with the 'github-actions' tag.
# https://community.rstudio.com/new-topic?category=Package%20development&tags=github-actions
on:
  push:
    branches:
      - main
      - master
  pull_request:
    branches:
      - main
      - master

name: R-CMD-check

jobs:
  R-CMD-check:
    runs-on: ${{ matrix.config.os }}

    name: ${{ matrix.config.os }} (${{ matrix.config.r }})

    strategy:
      fail-fast: false
      matrix:
        config:
          - {os: windows-latest, r: 'release'}
          - {os: macOS-latest, r: 'release'}
          - {os: ubuntu-20.04, r: 'release', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}
          - {os: ubuntu-20.04, r: 'devel', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}

    env:
      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
      RSPM: ${{ matrix.config.rspm }}
      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
      MY_SECRET: ${{ secrets.MY_SECRET }}
      MY_SECRET2: ${{ secrets.MY_SECRET2 }}

    steps:

      - uses: actions/checkout@v2

      - uses: r-lib/actions/setup-r@v1
        with:
          r-version: ${{ matrix.config.r }}

      - uses: r-lib/actions/setup-pandoc@v1

      - name: Query dependencies
        run: |
          install.packages('remotes')
          saveRDS(remotes::dev_package_deps(dependencies = TRUE), ".github/depends.Rds", version = 2)
          writeLines(sprintf("R-%i.%i", getRversion()$major, getRversion()$minor), ".github/R-version")
        shell: Rscript {0}

      - name: Cache R packages
        if: runner.os != 'Windows'
        uses: actions/cache@v2
        with:
          path: ${{ env.R_LIBS_USER }}
          key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
          restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-

      - name: Install system dependencies
        if: runner.os == 'Linux'
        run: |
          while read -r cmd
          do
            eval sudo $cmd
          done < <(Rscript -e 'writeLines(remotes::system_requirements("ubuntu", "20.04"))')

      - name: Install dependencies
        run: |
          remotes::install_deps(dependencies = TRUE)
          remotes::install_cran("rcmdcheck")
        shell: Rscript {0}

      - name: Run Tests
        env:
          MY_SECRET2: ${{ secrets.MY_SECRET2 }}
        run: |
          Sys.setenv(MY_SECRET2 = "$MY_SECRET2")
          testthat::test_file('my_test.R')
        shell: Rscript {0}

      - name: Check
        env:
          _R_CHECK_CRAN_INCOMING_REMOTE_: false
        run: rcmdcheck::rcmdcheck(args = c("--no-manual", "--as-cran"), error_on = "warning", check_dir = "check")
        shell: Rscript {0}

      - name: Upload check results
        if: failure()
        uses: actions/upload-artifact@main
        with:
          name: ${{ runner.os }}-r${{ matrix.config.r }}-results
          path: check

You'll notice that I have even tried using Sys.setenv() but that doesn't work either (and is not a very scalable solution).

How can I get this to pass?

Answer 1

One solution that works, create ~/.Renviron within a block

- name: Create and populate .Renviron file
  run: |
    echo MY_SECRET="$MY_SECRET" >> ~/.Renviron
    echo MY_SECRET2="$MY_SECRET2" >> ~/.Renviron
    shell: bash

As long as this goes before your tests, this will work. It has been added to the github repo listed.