# .github/workflows/deploy.yml - name: Create .secrets file run: | echo "DATABASE_PASSWORD=$ secrets.DB_PASS " >> .secrets echo "API_KEY=$ secrets.API_KEY " >> .secrets For containers, you never want the .secrets file baked into the Docker image. If someone downloads your image, they get your keys.
In the golden age of DevOps, containers, and cloud-native development, we have become obsessed with speed. We push code to production dozens of times a day. We spin up entire infrastructures with a single terraform apply . But in this rush to automate, we created a paradox: the easier we make deployment, the harder we make security. .secrets
Here is the professional workflow for .secrets : The developer never touches the production .secrets file. Instead, they authenticate with the Vault using their SSO (Single Sign-On). The Vault generates a temporary .secrets file locally for development only , filled with dummy or low-privilege data. 2. The CI/CD Injection In your pipeline (e.g., GitHub Actions), you do not store the .secrets file in the repo. Instead, you store each secret as an encrypted Repository Secret . During the build, the pipeline reads the encrypted variables and dynamically creates a .secrets file inside the ephemeral container. We push code to production dozens of times a day