Currently I haven't formalized/standardized how to work with the local development OAuth credentials. I need to standardize this and document it so there's a clear workflow/it won't run into any problems.
Here's a good guide:
https://microsoft.github.io/code-with-engineering-playbook/CI-CD/dev-sec-ops/secrets-management/#general-approach
https://microsoft.github.io/code-with-engineering-playbook/CI-CD/dev-sec-ops/secrets-management/#python
tekneos opened https://gitlab.wikimedia.org/toolforge-repos/wd-act/-/merge_requests/2
Simplify local development scripts to work correctly with gitignore, etc. #T434990
tekneos merged https://gitlab.wikimedia.org/toolforge-repos/wd-act/-/merge_requests/2
Simplify local development scripts to work correctly with gitignore, etc. #T434990
Added a script setup to work easily on local dev machines. Still need to update dev documentation and make sure the production config is ok.
For the production configuration:
According to this page, toolforge environment variables are stored as k8s Secrets: https://wikitech.wikimedia.org/wiki/Portal:Toolforge/Admin/Envvars_Service
This means that they should be persistent long-term. IE: I shouldn't have to worry about backing up the OAuth secrets in a second place. Discussed this a bit in the #wikimedia-cloud IRC channel on 8/15/2026.
So therefore, the plan is: Store the oauth config inside of toolforge environment variables long-term. If they ever need to be updated to new values, I can hop in to Toolforge and update them there.
All that's left to do is update the dev docs.
Updated the docs in this commit: https://gitlab.wikimedia.org/toolforge-repos/wd-act/-/commit/d0c31d76424e57d637dbc849d45bf0fefd5bc17c
This is good to go now - closing.