46Production deploys must use an approved reusable workflow. How do you enforce that in GitHub OIDC trust?▼hardNewGitLabMicrosoftAtlassian◆ premiumA token naming the right repository does not prove that the approved deployment workflow ran. Bind the caller, deployment context and called workflow into the cloud trust contract.Open full answer →
04Your CI stores a long-lived cloud access key. Replace it, and explain what the replacement actually proves.▼hard★ EssentialNewGitLabStripeJPMorgan Chase2 repliesunlockedThe single highest-value security change available to most pipelines, and the reason it works is worth understanding rather than configuring. It removes the secret rather than protecting it.Open full answer →
