WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 25, 2024

Best Practices for Using GitHub Secrets

Marcel Lupo

Relying solely on repository-level GitHub secrets creates severe operational bottlenecks. Discover how integrating Azure Key Vault and OIDC federation transforms secret management into an automated, passwordless workflow.

Pause
Mute Enter Fullscreen
#1 about 3 min

Understanding the necessity of secrets management in codebases

Protecting sensitive data like API keys prevents system compromise and ensures operational compliance.

#2 about 3 min

Configuring secrets for GitHub Actions Codespaces and Dependabot workflows

Navigating different secret categories in the user interface helps isolate variables for specialized workload automations.

#3 about 2 min

Differentiating environment organization and repository level credential security scopes

Evaluating administrative limitations across organizational layers enables more deliberate credential isolation strategies between teams.

#4 about 2 min

Creating and updating repository secrets inside the GitHub interface

Registering secure credentials effectively requires careful management because stored values cannot be viewed after creation.

#5 about 3 min

Consuming stored variables and recapping limits around secure deployments

Referencing encrypted repository variables in automated deployments demands balancing pipeline functionality against configuration maintenance overhead.

#6 about 2 min

Avoiding common security pitfalls and improper access authorization controls

Overcoming the risks of hardcoded credentials demands strict mitigation against persistence in branches and workflow execution logs.

#7 about 5 min

Centralizing credentials management using Azure Key Vault resource integration

Utilizing a centralized cloud vault provides robust cryptographic storage spanning multiple deployment repositories and external dependencies.

#8 about 5 min

Setting up passwordless federated identity configuring OpenID Connect patterns

Configuring modern authentication between external platforms and Entra ID utilizes stateless and dynamic service principals.

#9 about 3 min

Configuring GitHub application identifiers to authorize cloud vault retrievals

Exchanging application identity variables implements precise role-based access control without periodically rotating traditional system passwords.

#10 about 4 min

Executing deployment workflows explicitly reading identities from cloud vaults

Connecting shell scripts targeting vault properties ensures sensitive data remains dynamically fetched rather than statically embedded.

#11 about 3 min

Triggering sequential pipelines and verifying execution log secret masking

Observing automated workload iterations confirms that fetched infrastructure identifiers stay safely obscured across console execution logs.

#12 about 5 min

Exploring granular vault permissions and administrative auditing tracking benefits

Restricting access around specific cryptographic records guarantees that rotation metadata supports robust operational compliance audits.

#13 about 1 min

Accessing technical presentation resources and public architectural repository guides

Retrieving demonstration configurations containing scripts assists with independent verification alongside comprehensive developer community documentation entries.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto Alex Soto · LIVE

3:42 min

Best practices for ignoring and securely vaulting secrets

Dwayne Mcdaniel · LIVE

3:23 min

Securing enterprise infrastructure with GitHub Agentic Workflows

Krzysztof Cieślak Krzysztof Cieślak · WWC Europe 2026

2:03 min

Additional resources on GitOps and Kubernetes secret management

Alex Soto Alex Soto · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash
Open session

World Congress 2026 North America

Zero-Trust Architecture for Agentic AI: Securing Multi-User Access and Third-Party Integrations

Borko Djurkovic

Member of Technical Staff at Cohere

Borko Djurkovic

Related videos

Securing Secrets in the GitOps era thumbnail
58:57
LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Securing secrets in the GitOps Era thumbnail
58:52
LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail
56:06
LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

CI/CD with Github Actions thumbnail
1:05:06
LIVE • over 2 years ago

CI/CD with Github Actions

Chris Ayers

Real-World Security for Busy Developers thumbnail
29:50
WWC 2025 • 12 months ago

Real-World Security for Busy Developers

Kevin Lewis

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
WWC 2023 • over 2 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.