XSF Discussion - 2021-09-14

😊

Do we have secrets on Travis? https://travis-ci.community/t/security-bulletin/12081

news at 11

good thing they totally killed travis-ci for most projects a few months ago or that could have been bad

why is everyone surprised about this?

that's exactly how CI tools work

either you leak secrets to PRs, or you get no meaningful CI?

Hadn't everyone already moved towards the later?

damn this isn't good https://mobile.twitter.com/peter_szilagyi/status/1437646118700175360

jonas’, no it's meant to not leak secrets, because building/checking doesn't need secrets, but deploying master or whatever does

depends

my test workflows sometimes require secrets

if they talk to some IaaS for instance.

this is the only thing I can find on it at the moment https://github.com/travis-ci/travis-ci/issues/10117

but it never shared secrets with PRs from other repositories as far as I know