WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 25, 2024

Best Practices for Using GitHub Secrets

Marcel Lupo

Relying solely on repository-level GitHub secrets creates severe operational bottlenecks. Discover how integrating Azure Key Vault and OIDC federation transforms secret management into an automated, passwordless workflow.

Pause
Mute Enter Fullscreen
#1 about 3 min

Understanding the necessity of secrets management in codebases

Protecting sensitive data like API keys prevents system compromise and ensures operational compliance.

#2 about 3 min

Configuring secrets for GitHub Actions Codespaces and Dependabot workflows

Navigating different secret categories in the user interface helps isolate variables for specialized workload automations.

#3 about 2 min

Differentiating environment organization and repository level credential security scopes

Evaluating administrative limitations across organizational layers enables more deliberate credential isolation strategies between teams.

#4 about 2 min

Creating and updating repository secrets inside the GitHub interface

Registering secure credentials effectively requires careful management because stored values cannot be viewed after creation.

#5 about 3 min

Consuming stored variables and recapping limits around secure deployments

Referencing encrypted repository variables in automated deployments demands balancing pipeline functionality against configuration maintenance overhead.

#6 about 2 min

Avoiding common security pitfalls and improper access authorization controls

Overcoming the risks of hardcoded credentials demands strict mitigation against persistence in branches and workflow execution logs.

#7 about 5 min

Centralizing credentials management using Azure Key Vault resource integration

Utilizing a centralized cloud vault provides robust cryptographic storage spanning multiple deployment repositories and external dependencies.

#8 about 5 min

Setting up passwordless federated identity configuring OpenID Connect patterns

Configuring modern authentication between external platforms and Entra ID utilizes stateless and dynamic service principals.

#9 about 3 min

Configuring GitHub application identifiers to authorize cloud vault retrievals

Exchanging application identity variables implements precise role-based access control without periodically rotating traditional system passwords.

#10 about 4 min

Executing deployment workflows explicitly reading identities from cloud vaults

Connecting shell scripts targeting vault properties ensures sensitive data remains dynamically fetched rather than statically embedded.

#11 about 3 min

Triggering sequential pipelines and verifying execution log secret masking

Observing automated workload iterations confirms that fetched infrastructure identifiers stay safely obscured across console execution logs.

#12 about 5 min

Exploring granular vault permissions and administrative auditing tracking benefits

Restricting access around specific cryptographic records guarantees that rotation metadata supports robust operational compliance audits.

#13 about 1 min

Accessing technical presentation resources and public architectural repository guides

Retrieving demonstration configurations containing scripts assists with independent verification alongside comprehensive developer community documentation entries.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto Alex Soto · LIVE

3:42 min

Best practices for ignoring and securely vaulting secrets

Dwayne Mcdaniel · LIVE

3:23 min

Securing enterprise infrastructure with GitHub Agentic Workflows

Krzysztof Cieślak Krzysztof Cieślak · World Congress 2026 Europe

2:03 min

Additional resources on GitOps and Kubernetes secret management

Alex Soto Alex Soto · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
13 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
14 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
21 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
28 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
about 1 month ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - The Shape of SVG to Come! thumbnail
59:56
about 2 months ago

WeAreDevelopers LIVE - The Shape of SVG to Come!

Chris Heilmann, Daniel Cranney, Lionel Péramo

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov
Open session

World Congress 2026 North America

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

How Docker caught a supply chain attack in 83 minutes

Khushboo Verma

Systems Engineer at Cloudflare

Khushboo Verma
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Securing Secrets in the GitOps era thumbnail
58:57
LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Securing secrets in the GitOps Era thumbnail
58:52
LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail
56:06
LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

CI/CD with Github Actions thumbnail
1:05:06
LIVE • over 2 years ago

CI/CD with Github Actions

Chris Ayers

Real-World Security for Busy Developers thumbnail
29:50
World Congress 2025 • 12 months ago

Real-World Security for Busy Developers

Kevin Lewis

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
World Congress 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.