Guard the Deploy Secrets

A deploy workflow needs AWS credentials — and pasting them into the YAML is how leaks happen. Write a deploy workflow that reads its keys from GitHub Secrets, then record the secret inventory in a checklist file so the next engineer knows what exists and where it lives.

Validator

⏱ 0:00

IDLE — checks run live as you type commands; submit when done

01Requirements

live checks

File ~/project/.github/workflows/deploy.yaml exists○
The workflow checks out the code and reads AWS_ACCESS_KEY_ID from GitHub Secrets○
File ~/project/secrets-checklist.txt documents the AWS_ACCESS_KEY_ID secret○

02Walkthrough

1 of 9 revealed

01
Create the workflows directory
GitHub only reads workflow files from .github/workflows/ inside the repository — the same hidden directory the CI workflow lives in. mkdir -p creates every missing parent at once.
mkdir -p ~/project/.github/workflows
8 locked · each failed submit reveals one

03Stuck?

0 of 3 revealed

Take a hint without losing the lab — each one points at the thing to look at, not at the answer.

04AI Tutor

guides, never solves

Tell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?

04Notebook

saved locally in this browser

learner@lab — ubuntu:24.04

Session is disposable

↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list

← Previous lab

Build and Push a Docker Image in CI

CI/CD

Next lab →

Add an Approval Gate to a Deployment

CI/CD