Writing · secrets
2 posts tagged secrets, newest first.
A secrets-only merge can produce no workflow run at all: the paths filter decides whether a run exists, the scope job decides which hosts it reaches.
Ciphertext in git, plaintext at activation. The sops store protects the repository, so the leak this fleet actually had was a running system quoted into a log.