Restrict sensitive variables to protected branches or tags.
Section: Harden pipeline credentials and permissions
Protect production variables in GitLab
yaml
yaml
deploy_production:
stage: deploy
only:
- mainExplanation
Pair protected branches/tags with protected variables so untrusted branches cannot access deploy secrets.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Harden pipeline credentials and permissions
Use least-privilege permissions in GitHub Actions
Explicitly scope the token for each workflow or job.
Use OIDC instead of long-lived cloud keys
Exchange a short-lived identity token for cloud credentials.
Pin actions to a version or commit
Avoid floating references for critical workflow dependencies.
Require approval for production release
Add environment rules or manual gates before prod deploys.