Secrets in CI: Workflow and infrastructure

Binds CI jobs to cloud roles through OIDC, forbids long-lived PATs in logs and artifacts, locks secrets to protected environments, and isolates fork pull requests from production credentials.

Published Sep 12, 2026