Let federated CI read one cloud secret instead of duplicating it
When CI already authenticates to a cloud with workload identity federation, prefer a secret-level read grant over copying the same runtime credential into the CI platform. Fetch the exact secret only in the gated step that needs it, reject empty or multiline values, mask it befor…