WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Sep 25, 2024

Best Practices for Using GitHub Secrets

Marcel Lupo

Relying solely on repository-level GitHub secrets creates severe operational bottlenecks. Discover how integrating Azure Key Vault and OIDC federation transforms secret management into an automated, passwordless workflow.

Pause
Mute Enter Fullscreen
#1 about 3 min

Understanding the necessity of secrets management in codebases

Protecting sensitive data like API keys prevents system compromise and ensures operational compliance.

#2 about 3 min

Configuring secrets for GitHub Actions Codespaces and Dependabot workflows

Navigating different secret categories in the user interface helps isolate variables for specialized workload automations.

#3 about 2 min

Differentiating environment organization and repository level credential security scopes

Evaluating administrative limitations across organizational layers enables more deliberate credential isolation strategies between teams.

#4 about 2 min

Creating and updating repository secrets inside the GitHub interface

Registering secure credentials effectively requires careful management because stored values cannot be viewed after creation.

#5 about 3 min

Consuming stored variables and recapping limits around secure deployments

Referencing encrypted repository variables in automated deployments demands balancing pipeline functionality against configuration maintenance overhead.

#6 about 2 min

Avoiding common security pitfalls and improper access authorization controls

Overcoming the risks of hardcoded credentials demands strict mitigation against persistence in branches and workflow execution logs.

#7 about 5 min

Centralizing credentials management using Azure Key Vault resource integration

Utilizing a centralized cloud vault provides robust cryptographic storage spanning multiple deployment repositories and external dependencies.

#8 about 5 min

Setting up passwordless federated identity configuring OpenID Connect patterns

Configuring modern authentication between external platforms and Entra ID utilizes stateless and dynamic service principals.

#9 about 3 min

Configuring GitHub application identifiers to authorize cloud vault retrievals

Exchanging application identity variables implements precise role-based access control without periodically rotating traditional system passwords.

#10 about 4 min

Executing deployment workflows explicitly reading identities from cloud vaults

Connecting shell scripts targeting vault properties ensures sensitive data remains dynamically fetched rather than statically embedded.

#11 about 3 min

Triggering sequential pipelines and verifying execution log secret masking

Observing automated workload iterations confirms that fetched infrastructure identifiers stay safely obscured across console execution logs.

#12 about 5 min

Exploring granular vault permissions and administrative auditing tracking benefits

Restricting access around specific cryptographic records guarantees that rotation metadata supports robust operational compliance audits.

#13 about 1 min

Accessing technical presentation resources and public architectural repository guides

Retrieving demonstration configurations containing scripts assists with independent verification alongside comprehensive developer community documentation entries.

Matching moments

6:14 min

Introduction to securing secrets in GitOps deployments

Alex Soto Alex Soto · LIVE

3:42 min

Best practices for ignoring and securely vaulting secrets

Dwayne Mcdaniel · LIVE

3:23 min

Securing enterprise infrastructure with GitHub Agentic Workflows

Krzysztof Cieślak Krzysztof Cieślak · World Congress 2026 Europe

2:03 min

Additional resources on GitOps and Kubernetes secret management

Alex Soto Alex Soto · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

3:09 min

Injecting sensitive configuration values via Kubernetes secrets

Hannes Norbert Göring · LIVE

More from WeAreDevelopers LIVE

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
6 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
11 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers - Of Agents and Robots thumbnail
1:04:42
11 days ago

WeAreDevelopers - Of Agents and Robots

Chris Heilmann, Daniel Cranney, Marc Plogas

WeAreDevelopers LIVE - How DevRel Makes Tech More Human thumbnail
48:06
18 days ago

WeAreDevelopers LIVE - How DevRel Makes Tech More Human

Chris Heilmann, Daniel Cranney

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres thumbnail
7:41
19 days ago

Fake or News: Smart Glasses in Court, Medical Advice Watches & Mushroom Electonics - Jason Torres

Chris Heilmann, Daniel Cranney

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
about 1 month ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 10:20–10:50

Stage 6

Practices, Not Prompts: Scale GitHub Copilot with AI-Ready Repositories

Luis Pujols

Staff Customer Success Architect, GitHub

Luis Pujols
Open session

World Congress 2026 North America

September 24, 2026 · 13:30–15:30

Stage 12

GitHub Actions

Austen Stone

Senior Field Actions Specialist, GitHub

Austen Stone
Open session

World Congress 2026 North America

September 23, 2026 · 15:45–17:45

Stage 10

Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security

Ajeet Raina

Developer Advocate, Docker

Ajeet Raina
Open session

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 11

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Front-End Advocate | Speaker | AI & DevOps | Docker Captain | Cursor Ambassador | DevReal | Tech Blogger | Book Author

Kristiyan Velkov
Open session

World Congress 2026 North America

September 25, 2026 · 10:20–10:50

Stage 6

Agentic Code Validation and Repository Automation with Agentic Workflows

Jose Palafox

Field Copilot Specialist, GitHub

Jose Palafox

Related videos

Securing Secrets in the GitOps era thumbnail
58:57
LIVE • over 3 years ago

Securing Secrets in the GitOps era

Alex Soto

Securing secrets in the GitOps Era thumbnail
58:52
LIVE • over 2 years ago

Securing secrets in the GitOps Era

Davide Imola

Stop Committing Your Secrets - GIt Hooks To The Rescue! thumbnail
56:06
LIVE • over 3 years ago

Stop Committing Your Secrets - GIt Hooks To The Rescue!

Dwayne Mcdaniel

CI/CD with Github Actions thumbnail
1:05:06
LIVE • over 2 years ago

CI/CD with Github Actions

Chris Ayers

Real-World Security for Busy Developers thumbnail
29:50
World Congress 2025 • about 1 year ago

Real-World Security for Busy Developers

Kevin Lewis

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
World Congress 2023 • almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.