中文
devexamples
← Workflows

阅读中文版本

CI Pipeline Secrets Hygiene Workflow

Store CI secrets in the platform secret store, scope them per environment, mask them in logs, and rotate and audit access regularly.

intermediate~90 mincisecuritysecrets

Objective

Keep CI secrets secure and limited in scope so a compromised pipeline cannot reach unrelated environments.

Environment

  • A CI platform with secret storage and log masking
  • Access controls per environment

Steps

1. Move secrets out of pipeline files

Move secrets out of pipeline files into the platform secret store.

Expected state: Secrets are not in version control.

2. Scope secrets to the environments

Scope secrets to the environments and jobs that need them.

Expected state: A job cannot reach unrelated secrets.

3. Enable log masking and avoid echoing

Enable log masking and avoid echoing secrets.

Expected state: Secrets do not leak into logs.

4. Rotate secrets and audit who

Rotate secrets and audit who and which jobs can read them.

Expected state: Access stays current and accountable.

Decision points

Shared secrets across environments or separate?

  • Separate per environment
  • One shared set

Separate per environment; a shared production secret reachable from a dev job is an avoidable risk.

OIDC or long-lived keys?

  • Short-lived OIDC
  • Static keys

Prefer short-lived OIDC federation over static keys; static keys are long-lived and hard to rotate safely.

Expected outcome

CI secrets in the platform store, scoped per environment, masked in logs, rotated, and audited.

Verification

Confirm secret scanners find none in the repository and that a job cannot read secrets scoped to another environment.

Cleanup

Record the rotation schedule and the access audit results.

Overview

Keep CI secrets secure and limited in scope so a compromised pipeline cannot reach unrelated environments. Confirm secret scanners find none in the repository and that a job cannot read secrets scoped to another environment.

Steps

  1. Move secrets out of pipeline files into the platform secret store. Expected state: Secrets are not in version control.
  2. Scope secrets to the environments and jobs that need them. Expected state: A job cannot reach unrelated secrets.
  3. Enable log masking and avoid echoing secrets. Expected state: Secrets do not leak into logs.
  4. Rotate secrets and audit who and which jobs can read them. Expected state: Access stays current and accountable.
permissions:
  id-token: write   # OIDC
  contents: read
# then assume a role with a short-lived token instead of a static key

Verification

  • CI secrets in the platform store, scoped per environment, masked in logs, rotated, and audited.

Decision points

  • Shared secrets across environments or separate? Options: Separate per environment; One shared set. Recommended: Separate per environment; a shared production secret reachable from a dev job is an avoidable risk.
  • OIDC or long-lived keys? Options: Short-lived OIDC; Static keys. Recommended: Prefer short-lived OIDC federation over static keys; static keys are long-lived and hard to rotate safely.