| Filename | Latest commit message | Latest commit date |
|---|---|---|
6516f756f3Addresses the security concern where secrets were directly interpolated in GitHub Actions run commands across multiple workflows. Following [GitHub's security best practices](https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable), secrets are now passed through intermediate environment variables (matching the secret names: `PULUMI_STAGING_PASSPHRASE` and `PULUMI_PROD_PASSPHRASE`) before being written to files. ## Changes **deploy.yml:** - Fixed staging deployment (line 92) - Fixed production deployment (line 131) **cancel-pulumi-lock.yml:** - Fixed staging lock cancellation (line 62) - Fixed production lock cancellation (line 70) ## Benefits This approach: - Fixes the security issue with direct secret interpolation in 4 locations - Maintains compatibility with existing local development workflows - Keeps the Makefile unchanged - Uses environment variable names that match the secret names for clarity The key improvement is that `${{ secrets.X }}` is no longer expanded directly in the run commands, reducing the risk of accidental disclosure if GitHub's masking fails or is bypassed. |
||
| .. | ||
| workflows | ||
| dependabot.yml | ||