4 ms·
Gitlab has protected variables which are only made available to protected branches (i.e. the ones that would have deploy stages). But yeah in general secrets m
by qeternity 6y ago
Gitlab has protected variables which are only made available to protected branches (i.e. the ones that would have deploy stages).
But yeah in general secrets management is a trainwreck.
- WhyNotHugo 6y agoThose branches still run tests and coverage, so it’s likely that code of would run on them anyway.
- deleted 6y ago[deleted]
- lloeki 6y agoThe design is that such tests would be run in PR non-protected branches and thus reviewed before being merged into protected branches for later deployment; that, we agree as much. I guess the protected branch segregation should go -both ways- and more effort should be made into auditing and vetting which CI step has run access to secret-authorised branches.
- CameronNemo 6y agoProtected secrets has always seemed like such a rough barrier. No fine tuning at all (e.g. if you have stage and prod creds that you want to be kept separate, but both "protected"... No good way to do that from my POV).