Scalingo and GitHub Actions: Isolating Review App Provisioning from Production Credentials

Answer

The most restrictive combination of Scalingo API scopes that lets a GitHub Actions workflow create and delete Review Apps while preventing any access to production environment variables or add‑on configurations is:

• app:create
• app:delete
• env:write

These scopes do not include env:read or any account‑level scopes, so the token cannot list or read environment variables of any app, including production ones.

How CI‑injected env vars stay isolated

1. Store the token as a GitHub Secret (e.g., SCALINGO_TOKEN) and reference it only in the steps that run the Scalingo CLI.
2. Generate a unique app name for each workflow run, for example:

APP_NAME="review-${{ github.head_ref }}-${{ github.sha }}"
# Truncate to 63 characters if needed


Use the --app flag (or SCALINGO_APP env var) with every Scalingo command so the operation targets only the newly created app:

scalingo apps-create $APP_NAME
scalingo env-set --app $APP_NAME KEY=value
# run tests …
scalingo apps-delete $APP_NAME

Because the token lacks env:read, the workflow cannot call scalingo env-list or scalingo env-show on any other app, guaranteeing that the variables set with env-set remain confined to the Review App.
Steps to implement

In the Scalingo dashboard, create an API token with exactly the scopes app:create, app:delete, env:write.
Add the token to your repository as a secret named SCALINGO_TOKEN.
In your GitHub Actions workflow, set an environment variable for the unique app name (see example above).
Run the sequence: scalingo apps-create, scalingo env-set, execute your test suite, then scalingo apps-delete.
Ensure the Scalingo CLI version you use supports the --app flag for env-set and apps-delete; older versions may require setting SCALINGO_APP instead.

Missing diagnostic detail
Confirm that the Scalingo CLI version installed in your runner supports the --app flag for env-set and apps-delete. If it does not, you will need to rely on the SCALINGO_APP environment variable instead, which changes the exact command syntax but does not affect the required token scopes.