Question

Your enterprise's security team mandates that all long-lived credentials be centralized in HashiCorp Vault rather than stored as GitHub Actions encrypted secrets. A platform team needs their Actions workflows to retrieve database credentials from Vault at runtime without storing any static Vault token in GitHub. Which approach best satisfies this requirement?

Accepted Answer

Configure Vault to trust GitHub's OIDC provider and have workflows exchange a short-lived GitHub-issued OIDC token for a Vault token using the JWT auth method.

Answer

Store a Vault root token as an organization-level encrypted secret and reference it in every workflow to authenticate to Vault.

Answer

Copy the credentials from Vault into repository-level encrypted secrets nightly using a scheduled workflow so they stay synchronized.

Answer

Enable IP allow lists on the runner group so only Vault can reach the runners, eliminating the need for authentication.