All 16 CI/CD, Publishing & Deployment questions
More in CI/CD, Publishing & Deployment
What is the typical CI/CD pipeline structure for a .NET application? What is the difference between continuous integration (CI) and continuous deployment/delivery (CD)? How do you configure a GitHub Actions workflow to build, test, and publish a .NET application? What is the purpose of separate build and release pipelines (or stages), and why shouldn't you rebuild the application for each deployment environment? What is the role of automated smoke tests and health checks immediately after a deployment completes? How do you version and tag Docker images for a .NET application as part of a CI/CD pipeline? How do feature flags decouple code deployment from feature release in a CI/CD workflow? What is the difference between dotnet publish's --self-contained and framework-dependent options in the context of container image builds? What is the difference between blue-green deployment and canary deployment, and how do they apply to .NET applications? How do you set up automated database migrations as part of a .NET CI/CD deployment pipeline safely?
Advertisement
.NET › CI/CD, Publishing & Deployment

How do you securely manage secrets (connection strings, API keys) in a CI/CD pipeline without committing them to source control?

Intermediate

Answer

CI/CD platforms provide encrypted secret storage (GitHub Actions Secrets, Azure DevOps variable groups with secret variables, GitLab CI/CD variables) injected as environment variables only during pipeline execution, never exposed in logs or the repository itself -- combined with cloud-native secret managers (Azure Key Vault, AWS Secrets Manager) for runtime application secrets, keeping build-time and run-time secret concerns properly separated.
# GitHub Actions: referencing a repository secret
- name: Deploy
  env:
    CONNECTION_STRING: ${{ secrets.PROD_DB_CONNECTION_STRING }}
  run: dotnet run --project deploy-tool
Real-world example A pipeline deploying to Azure retrieves its deployment credentials from GitHub Actions Secrets rather than a hardcoded config file, and the application itself retrieves its database connection string from Azure Key Vault at runtime rather than from pipeline-injected environment variables.

Common follow-ups: Why shouldn't runtime application secrets be the same as CI/CD pipeline secrets?;How do you rotate a secret without pipeline downtime?

Secrets Management & Configuration Providers (Key Vault User Secrets);Configuration & Options
All 16 CI/CD, Publishing & Deployment questions