Quick Notes129 words
Sensitive files during deployment — quick notes
Sensitive files — quick notes
| Need | Mechanism |
|---|---|
| Signing certificate, keystore, provisioning profile | Secure files library |
| Retrieve during a job | DownloadSecureFile@1 |
| Selected Key Vault secret needed as a pipeline value | Key Vault-linked variable group |
- Secure files are protected resources. Selected YAML pipelines can be authorized; all classic pipelines can access secure files.
- The download task deletes its managed download at job end on either agent type. Separately clean copied or installed artifacts.
- Revoke or rotate committed private-key material first; rotation does not purge Git history, so coordinate cleanup across affected clones and forks.
Primary sources
- https://learn.microsoft.com/en-us/azure/devops/pipelines/library/secure-files?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/download-secure-file-v1?view=azure-pipelines
- https://learn.microsoft.com/en-us/azure/devops/pipelines/process/about-resources?view=azure-devops
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
- https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/pipelines/library/link-variable-groups-to-key-vaults?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/repos/tfvc/comparison-git-tfvc?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted?view=azure-devops
- https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/install-apple-certificate-v2?view=azure-pipelines