Pulumi eliminated all long-lived static CI secrets across 70+ provider repositories by replacing GitHub Secrets with short-lived, dynamically fetched credentials using Pulumi ESC and OIDC. The approach chains GitHub-issued OIDC tokens through Pulumi Cloud to fetch ephemeral cloud credentials (AWS, Azure, GCP) at runtime, leaving nothing persistent to steal. The migration was managed centrally via ci-mgmt tooling, giving uniform patterns, centralized audit logging, and single-point credential rotation. In a supply chain attack scenario, a compromised GitHub Action finds no stored secrets and only short-lived tokens scoped to the current run.
Table of contents
The problem with static CI secretsOur approach: zero static secretsWhat the change looks likeScale: 70+ repos, zero static secretsAuditability and centralized controlWhat happens if a GitHub Action is compromisedGet startedSort: