Let federated CI read one cloud secret instead of duplicating it

When CI already authenticates to a cloud with workload identity federation, prefer a secret-level read grant over copying the same runtime credential into the CI platform. Fetch the exact secret only in the gated step that needs it, reject empty or multiline values, mask it before use, and pass it only to the target process rather than a job-wide environment file. Scope IAM to one existing secret and manage no versions from infrastructure code. This removes one rotation surface, but cloud IAM, federation, and secret service availability become release dependencies.

Applies when: GitHub Actions deploys cloud workloads through keyless federated identity. Keywords: GitHub Actions WIF Secret Manager least privilege secret duplication rotation CI