The issue, AIUI, is that folks just "add secrets" to their pipelines willy-nilly. Even though we run our own CI infra, we still:
- restrict secrets to protected refs (so MR pipelines don't get them)
- only provided to named environments (so that build jobs don't get upload tokens)
These secret-using jobs tend to be of the "install rsync, run rsync"-level of complexity to keep even what runs with access to the secrets to a minimum.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。