Binds CI jobs to cloud roles through OIDC, forbids long-lived PATs in logs and artifacts, locks secrets to protected environments, and isolates fork pull requests from production credentials.
Published Sep 12, 2026
This Block has no declared dependencies.