No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

forking a github repo doesn’t fork the secrets into that repo

<https://docs.github.com/en/actions/security-guides/encrypted-secrets>

I’m doing this here:
<https://github.com/jaxxstorm/lbrlabs>

I don’t set any values inside the pulumi project, I use OIDC for passing credentials: <https://github.com/jaxxstorm/lbrlabs/blob/main/delivery/index.ts>

Forking does not share secrets, but someone forks, adds a new github workflow that uses my secret, they can do whatever they want to the infrastructure once they open a PR on my repo.

we use a command dispatch workflow for this with Pulumi:
<https://github.com/pulumi/pulumi-aws/blob/master/.github/workflows/command-dispatch.yml>

So I would need a second private repository. Given I’m writing golang, I could just write packages and then import them..

Thank you gentlemen, this made my suspicion correct, I can’t get away with just a public repo

…I’m not sure how you came to that conclusion, it’s definitely possible.

I can't secure the secrets of my cloud provider in a public github repository..

You use command-dispatch for issues, right? Not sure what commands you're running.

&gt; I can’t secure the secrets of my cloud provider in a public github repository..
If you require approvals to run CI on any pull request, it’ll completely eliminate this problem

there are many ways to do this, command dispatch is just one of them

you can do it with the environments feature, for example: <https://cloudlumberjack.com/posts/github-actions-approvals/>

Ah approvals! True! Haven't thought of that. Thank you, that solves my issue :slightly_smiling_face:

I use a combination of secret config variables and environment variables that I store in an s3 bucket in aws. That makes me much more confident in my open source project using Pulumi