A better summary.
A better summary.
Posted Jun 11, 2026 16:10 UTC (Thu) by mathstuf (subscriber, #69389)In reply to: A better summary. by kleptog
Parent article: Eliminating long-lived credentials with trusted publishing
The issue, AIUI, is that folks just "add secrets" to their pipelines willy-nilly. Even though we run our own CI infra, we still:
- restrict secrets to protected refs (so MR pipelines don't get them)
- only provided to named environments (so that build jobs don't get upload tokens)
These secret-using jobs tend to be of the "install rsync, run rsync"-level of complexity to keep even what runs with access to the secrets to a minimum.