If one has an open source project that is deployed somewhere in the cloud via a continuous delivery pipeline, how can the programmatic credentials needed for the CI/CD to deploy the application remains private?
Normally in a private project on a private repository, one could lazily place those credentials in the pipeline steps code in order for the machine to be able to deploy the application.
Don't get me wrong, there are solutions to hide credentials somewhere else than in the code. credstash is a good example as it store your creds on AWS and you access them with your AWS user private access key. This key can be store on your AWS account and used on your computer. All of this making them live outside of your repository. But the point is that in order to have those hidden credentials on your CI/CD build machine, you have to somehow give your build machine a way to get to them. Meaning giving it creds that will end up in the repo again.
How are we supposed to do that?