clarify docs

README.md

@@ -4,7 +4,7 @@ A GitHub Action to deploy with Defang. Use this action to deploy your applicatio
 
 ## Usage
 
-The simplest usage is to deploy a compose-based project to the Defang Playground. This is done by adding the following to your GitHub workflow, assuming you have a `compose.yaml` file in the root of your repository.
+The simplest usage is to deploy a [Compose-based](https://github.com/compose-spec/compose-spec/blob/main/spec.md) project to the Defang Playground. This is done by adding the following to your GitHub workflow, assuming you have a `compose.yaml` file in the root of your repository.
 
 To do so, just add a job like the following to your GitHub workflow (note the permissions and the Deploy step):
 
@@ -26,7 +26,14 @@ jobs:
 
 ### Managing Config Values
 
-Defang allows you to [securely manage configuration values](https://docs.defang.io/docs/concepts/configuration). You can store your config using [GitHub Actions Secrets](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions) and then pass them through to the Defang action. To do so, make sure to set your env vars in the `env` section of the action. This is where you can pass the value of the secret. Then specify the names of the env vars you want Defang to use in the `configEnvVars` input. We do this for security reasons: we don't want to accidentally expose sensitive information in the logs, so you have to be explicit about which env vars you want Defang to submit as config.
+Defang allows you to [securely manage configuration values](https://docs.defang.io/docs/concepts/configuration). You can store your config using [GitHub Actions Secrets](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions) and then pass them through to the Defang action. 
+
+To publish a secret stored in GitHub to the cloud as a secure config value with defang, you need to do two things:
+
+  1. Use the `env` section of the step to pass the value of the secrets to environment variables that match the names of the config values in your Compose file.
+  2. Specify the names of the environment variables you want to push to the cloud as config values in the `config-env-vars` input.
+
+The second step is to make sure that we only publish the secrets you explicitly tell us to. For example, you could have a secret in an env var at the job level, instead of the step level that you might not want to push to the cloud, even if it is in a secure store.
 
 ```yaml
 jobs:
@@ -37,15 +44,16 @@ jobs:
     - name: Deploy
       uses: DefangLabs/defang-github-action@v1
       with:
-        configEnvVars: "API_KEY DB_CONNECTION_STRING"
+        # Note: you need to tell Defang which env vars to push to the cloud as config values here. Only these ones will be pushed up.
+        config-env-vars: "API_KEY DB_CONNECTION_STRING"
       env:
         API_KEY: ${{ secrets.API_KEY }}
         DB_CONNECTION_STRING: ${{ secrets.DB_CONNECTION_STRING }}
 ```
 
 ### Projects in a Subdirectory
 
-If your compose file is in a different directory than your project root, you can specify the path to the project in the `cwd` input.
+If your Compose file is in a different directory than your project root, you can specify the path to the project in the `cwd` input.
 
 ```yaml
 jobs:
@@ -61,7 +69,7 @@ jobs:
 
 ### Specifying the CLI Version
 
-If you want to use a specific version of the Defang CLI, you can specify it using the `cliVersion` input.
+If you want to use a specific version of the Defang CLI, you can specify it using the `cli-version` input.
 
 ```yaml
 jobs:
@@ -72,7 +80,7 @@ jobs:
     - name: Deploy
       uses: DefangLabs/defang-github-action@v1
       with:
-        cliVersion: v0.5.38
+        cli-version: v0.5.38
 ```
 
 ### Full Example
@@ -101,8 +109,8 @@ jobs:
     - name: Deploy
       uses: DefangLabs/defang-github-action@main
       with:
-        cliVersion: v0.5.38
-        configEnvVars: "API_KEY DB_CONNECTION_STRING"
+        cli-version: v0.5.38
+        config-env-vars: "API_KEY DB_CONNECTION_STRING"
         cwd: "./test"
       env:
         API_KEY: ${{ secrets.API_KEY }}