CI/CD

How pipelines get only the secrets they need: narrowly scoped service tokens, OIDC binding to a repository and branch, and keeping production out of CI.

RSS feed

Latest posts

.github/workflows/deploy.ymlkiteline/web-app

1permissions:2  id-token: write3  contents: read4steps:5  - name: Deploy to staging6    env:7      CRUNU_TOKEN: ${{ secrets.CRUNU_TOKEN }}8      CRUNU_SERVER: ${{ vars.CRUNU_SERVER }}9    run: exec crunu run --env web-app/staging -- npm run deploy

CI/CDOctober 27, 2026

Giving CI only the secrets it needs

Long-lived CI tokens work from anywhere until revoked. How to scope pipeline secrets, keep production out of CI, and bind tokens to a repo with OIDC.

Example. Kiteline is a fictional company.