4 ms·

Your prod deployment should require access to some secrets that are only available to workflows running against main.

• kelseydh 2y ago
  I'm interested in learning more about this. How would we go about adding a secret only available to runners on the main branch? Is there a configuration option on Github to create a secret only available to runners on main? Presumably anything configured via a .github workflow wouldn't assure safety, as those files can be edited to trigger unexpected actions like deploys on working branches. Our Github Action workflow yml file had a check to only deploy for changes to the main branch. The deploy got triggered because that check got removed from the workflow file in a commit on a working branch.
  • everfrustrated 2y ago
    I haven't used it but the GitHub Environments feature allows setting Secrets by Environment. Costs extra $ tho. But for actually good security CI and CD should be different tools.
  • carderne 2y ago
    The docs here [0] do a decent job explaining it. You create an environment, restrict it to the main branch, add your secret to it and then tie your deploy workflow to it. If someone runs that workflow against another branch it will run but it won’t be able to access those secrets. [0] https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment https://docs.github.com/en/actions/managing-workflow-runs-an...
    • kelseydh 2y ago
      Thank you, very helpful!