CD7: CI pipelines with GitHub Actions
Secrets, environments and cloud access
🎯You'll be able to
Store secrets for workflows, protect production with a GitHub environment that needs approval, and reach a cloud with OIDC instead of a key.
🏠The everyday picture
A bank locker needs two keys: yours and the bank officer's. The officer checks your identity each visit; you don't get a permanent copy of their key to take home.
📘What it really is
-
Secrets are encrypted values stored in GitHub and passed to workflows as
${{ secrets.NAME }}. They can belong to an organisation, a repository, or an environment. -
Environments (such as
production) add rules to any job that names them: - required reviewers: a person must approve before the job starts;
- deployment branches: only
main(or chosen branches) may deploy; - environment secrets: visible only to jobs in that environment, after approval;
-
a record of each deployment. RouteRani's deploy job has
environment: production, so production approvals and secrets can be added without changing the workflow. -
OIDC to a cloud (CD6 Lesson 2), for example AWS (not verified): ```yaml deploy: permissions: contents: read id-token: write environment: production steps:
- uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: arn:aws:iam::111122223333:role/routerani-deploy
aws-region: ap-south-1
`` The role's trust policy accepts tokens only from your repository'sproduction` environment. No access key is stored in GitHub.
- uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: arn:aws:iam::111122223333:role/routerani-deploy
aws-region: ap-south-1
-
Rotation: secrets that must exist (an API key for a third-party service) should be changed on a schedule and immediately after anyone with access leaves or a leak is suspected.
📝A worked example
Input: compare two deploy setups for RouteRani: (a) AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as repository secrets with no environment;
(b) an OIDC role trusted for the production environment, which requires one reviewer and only allows main.
Expected output: in (a), any workflow on any branch can read the keys, and a leaked key works until someone deletes it. In (b), a deploy needs a
person's approval, only main can deploy, the job's credentials expire after about an hour, and nothing long-lived is stored. (b) also shows who
approved each production deploy.
🌍Where it's used
- Regulated teams require named approvers for production and keep the deployment history as evidence.
- Cloud deploys at mature companies use OIDC from CI to AWS, Google Cloud or Azure.
- Separate environments (
staging,production) with separate secrets and reviewers.
📝Case scenario
An intern's experimental branch at a logistics company included a workflow that deployed to production, because the production cloud keys were
repository secrets available to every branch. A typo in the branch's Terraform removed a queue. Afterwards, production keys moved to an
environment that allowed only main and needed approval, and then to OIDC, so no keys were stored at all.
🖱️Try it
In GitHub, open a repository's Settings, then Environments, and read the options for a new environment (you don't have to save it). Success: you can name where required reviewers, deployment branches and environment secrets are set.
⚠️Common mistakes
- Production secrets at repository level. Sign: any branch's workflow can use them. Fix: environment secrets with branch rules.
- No approval for production. Sign: merges deploy straight to users with nobody watching. Fix: required reviewers, at least for risky services.
- Long-lived cloud keys. Sign: keys in secrets for years. Fix: OIDC roles with narrow trust conditions.
🛠️For your project
Project 2 test 4 checks the deploy job uses an environment. In your capstone write-up, describe the reviewers and OIDC trust you'd set for RouteRani's production.
✅Quick check
What does a GitHub environment add to a job?
Show the answer
Rules such as required reviewers, allowed branches and environment-only secrets.
What permission does a job need to use OIDC?
Show the answer
id-token: write.