CI/CD Pipelines: Security, Secrets, and Governance

permissions:
  contents: read

# Explicitly scope the token for each workflow or job.

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
      aws-region: us-east-1

# Exchange a short-lived identity token for cloud credentials.

deploy_production:
  stage: deploy
  only:
    - main

# Restrict sensitive variables to protected branches or tags.

- uses: actions/checkout@v4

# Avoid floating references for critical workflow dependencies.

on:
  pull_request:
    branches: [main]

# Avoid exposing secrets to code from forks.

Protect the production environment.
Require reviewers for prod deploy jobs.
Separate CI from production credentials.

# Add environment rules or manual gates before prod deploys.