Pipeline secrets require scope and trust boundaries. Code from untrusted contributions must not gain access merely because a job starts.
Before you start
You should understand commits, branches, the working tree and the staging area. Draw the commit graph before changing history. Try commands in a disposable repository with a clean working tree so you can observe exactly which references and files each operation changes.
The practical goal is to reason through this situation: A public contribution runs tests without deployment credentials. Read the walkthrough first, then try the interview exercise before opening its answer. The important part is explaining the decision and its consequences, rather than remembering a definition alone.
Step-by-step walkthrough
Step 1: Identify trusted execution
Untrusted contribution code must not run with deployment credentials.
Step 2: Scope credentials narrowly
Restrict privileged jobs to intended events, resources and permissions.
Step 3: Review secondary leakage
Logs, artifacts and verbose tooling can expose secrets.
Worked scenario
A public contribution runs tests without deployment credentials.
A pull request changes the test script to print environment variables. If that job receives deployment keys, the contributor can extract them. Run contribution checks without those keys and isolate trusted deployment execution; masking ordinary logs is not a complete defense against arbitrary privileged code.
Common mistake
Printing command environments or enabling verbose authentication logs can expose secrets.
Verify the behavior
Test event boundaries and secret availability without exposing real credentials.
Interview exercise
Design a deployment job.
Answer and reasoning
Restrict credentials to trusted events, use narrow permissions and prevent untrusted code from executing within the privileged context.
Continue learning
Compare the scenario with the Git and CI/CD interview questions and test your understanding with the Git and CI/CD MCQs. For terminology and implementation details, consult the reference material.