Rails 4.1 pushing secrets to heroku

Question

Rails 4.1.0.beta1 and Devise.

I'm trying to remove all of my keys from version control and I've upgraded to Rails 4.1 to give this new secrets.yml a shot

Trying to push Devise's config.secret_key to heroku but it's failing after assets:precompile

Preparing app for Rails asset pipeline
       Running: rake assets:precompile
       rake aborted!
       Devise.secret_key was not set. Please add the following to your Devise initializer:
       config.secret_key = 'EXAMPLE_KEY_HERE'
       Please ensure you restarted your application after installing Devise or setting the key.

Here are my changes, the old code I'll leave in comments. (it works)

devise.rb

  # config.secret_key = 'THIS_IS_A_FAKE_KEY' #<---this_is_commented_out
  config.secret_key = Rails.application.secrets.devise_secret_key

secrets.yml

production:
  devise_secret_key: 'THIS_IS_A_FAKE_KEY'

then ran heroku labs:enable user-env-compile -a myapp (not sure if that's necessary)

and then when I push to my forked heroku envionment git push forked master I get the above error.

I also noticed some discussion on this in this Devise repo so I figured I'd update my gem alongside the source repo, no difference. Here's part of that discussion (here).

Answer 1

You've likely got secrets.yml added to your .gitignore. Which makes sense, since you put secret keys in it -- but since Heroku deployment uses git, it never sees your secrets.yml.

One solution is to use the heroku_secrets gem - See https://stackoverflow.com/a/22458102/2831572 .

Another solution is to add secrets.yml to git (i.e. remove it from .gitignore) after replacing all sensitive keys with references to environment variables.
So:

production:
  devise_secret_key: <%= ENV['DEVISE_KEY'] %>

then run heroku config:set DEVISE_KEY='7658699e0f765e8whatever'