3 ms·
Let me help expand your imagination: what if the code is for sshing to prod and needs a ssh-agent or a password typed in? Would you leave those cress on your CI
by falsedan 9y ago
Let me help expand your imagination: what if the code is for sshing to prod and needs a ssh-agent or a password typed in? Would you leave those cress on your CI system? Would Security be happy with that?
- albertgoeswoof 9y agoWhy would a test build ever ssh to production? If you absolutely need to test connecting to an external system you should mock it or create an environment for testing against. Your credentials should also be stored as env variables so the test ones are used only for the test environment.
- falsedan 9y agoBecause you're developing automated tools to deploy to prod & you're verifying the correctness of the system end-to-end with a no-op command. The connecting to an external system is not what's under test, and assume I've written unit tests that mock out the sshing, and that even with a staging environment I have to smoke test the new code before switching everyone over to the new version. Where are those env variables stored on the CI system? In the job config? I would use Vault for this.