Signing keys and publication tokens are high-value pipeline assets. Keep them out of repositories and logs.
Evaluation approach
Use least privilege and prevent untrusted contributions from accessing release secrets. Connect key use to approved publication.
Application example
An external pull request must not execute commands with store-upload credentials.
Limits and considerations
A secret-variable feature does not make every command using it safe.
Can an error disclose a secret?
Failed commands may print different details. Inspect failure paths as well as successful builds, including subprocess and third-party masking behavior.
Checks and decisions
- Narrow job privileges
- Inspect logs
- Protect contribution boundaries
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.