Tighten secret scope in release.yml
#14627
Open
+9
−5
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add `environment: release` to the "publish-to-hex" job so that only
workflows explicitly targeting the release environment can read
sensitive values.
* Gate the job behind `if: ${{ vars.HEX_AWS_REGION }}` to avoid noisy
failures in forks where the variable is not configured.
* Replace `${{ secrets.HEX_AWS_REGION }}` / `${{ secrets.HEX_AWS_S3_BUCKET }}`
references with `${{ vars.* }}`. These are not credentials, so
environment-level *variables* are a better fit and keep them readable
only by jobs that declare the environment.
* Remove Fastly secrets from the job-wide `env:` block and inject them
only into the Fastly purge step, following the principle of least
privilege. Other steps no longer see these tokens.
Restricting secret visibility to an environment and to the exact step
that needs them reduces the blast radius of a compromised workflow run,
blocks accidental exposure in logs of unrelated steps, and stops forks
from obtaining privileged data.
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changed
environment: releaseto thepublish-to-hexjob so that only workflows explicitly targeting the release environment can read sensitive values.if: ${{ vars.HEX_AWS_REGION }}– to skip the job in forks that don’t define release variables.${{ vars.HEX_AWS_REGION }}${{ vars.HEX_AWS_S3_BUCKET }}These are configuration values, not credentials, so variables are a better fit and remain visible only to jobs using the
releaseenvironment.Why it matters
Placing secrets in an environment and scoping them to the minimum surface area:
TODO for Maintainers
HEX_AWS_REGION,HEX_AWS_S3_BUCKETHEX_AWS_ACCESS_KEY_IDHEX_AWS_SECRET_ACCESS_KEYHEX_FASTLY_REPO_SERVICE_IDHEX_FASTLY_BUILDS_SERVICE_IDHEX_FASTLY_KEYOnce the moves are complete, new release builds will run with the tighter permissions automatically.