Scalingo and GitHub Actions: Isolating Review App Provisioning from Production Credentials

Review App Automation and Scope Isolation

Implementing a CI/CD pipeline using GitHub Actions to automate Scalingo Review Apps requires a balance between automation and security. To prevent the accidental modification of production resources, the integration should rely on a token with limited scopes rather than a full administrative account.

The goal is to utilize the Scalingo Platform API or CLI to spawn temporary environments for feature branches. However, when configuring the SCALINGO_TOKEN within GitHub Secrets, there is uncertainty regarding the minimum viable scope required to create and destroy these apps without granting the workflow visibility into production environment variables or add-on configurations.

Given that concurrent GitHub workflow runs may attempt to provision apps simultaneously, the naming convention must also ensure uniqueness to avoid collisions within the account namespace.

• What is the most restrictive API scope that allows for both the creation and deletion of Review Apps while blocking access to production app settings?
• How can the integration ensure that environment variables injected via scalingo env-set during the CI process remain strictly isolated from the production environment's configuration?