Azure DevOps Secretless CI/CD via Workload Identity Federation
Key Questions
What is Azure DevOps secretless CI/CD and how does it work?
It leverages OIDC tokens and workload identity federation to eliminate stored secrets in Azure Pipelines, AWS CodePipeline, and related tools. This approach integrates with AzDO CLI, Terraform, and signing mechanisms for enhanced security.
How does Azure Artifact Signing improve trust and reduce risk?
Trust profiles distinguish between Public Trust Test and Public Trust to minimize certificate exposure during inner-loop development. This clarifies signing practices and supports batch operations via tools like SignTool + KSP.
What new resources cover Azure app signing implementation?
The Azure App Signing with SignTool + KSP article details batch signing for pipelines handling hundreds of artifacts, using DigiCert KeyLocker for efficient release processes.
OIDC tokens; AzDO CLI/AWS CodePipeline; tj-actions/artifact-signing; PowerShell/Azure Trusted Signing/SignTool; Terraform 3-tier; Postman/ACR. Azure Pipelines triggers for CI/scheduled/gated orchestration; AWS Lambda code signing with Terraform. New Q&A on Azure Artifact Signing trust profiles (Public Trust Test vs Public Trust) reduces certificate waste. New batch signing guide with SignTool + KSP extends practical pipeline signing.