alt Hacker NewsWe're iterating towards GHA for CI, AWS CodeBuild for the CD. At least on AWS projects. Mainly because managing IAM permissions to permit the github runner to do everything the deployment wants is an astonishingly large waste of time. But you need a secret to trigger one from the other.
You actually don’t need (long-lived / hard-coded) secrets in this scenario if you use OIDC:
https://docs.github.com/en/actions/how-tos/secure-your-work/...