正在加载视频...

视频加载失败

putting secrets in ci/cd usually means pasting api keys into github settings and hoping for the best relic's service accounts fix that: your pipeline gets its own identity and keys, one env var, nothing plaintext ever hits a server here's how:

26,782 次观看 • 2 个月前 •via X (Twitter)

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

Anthropic won't like this open-source repo. It is going to cost LLM providers a lot of money. Every CI run of an AI app today sends real requests to providers like OpenAI or Anthropic. Like any other LLM call, this too gets billed at actual API rates. So for teams with high commit volumes, this accumulates into a meaningful chunk of API spend. One common hack devs use is that instead of invoking the LLM API, the test calls a fake local server that speaks the same API and returns a dummy response. The catch is that the dummy response is a copy of what the provider returned on the day it was saved, and providers keep adding fields and changing types. So the tests keep passing against a schema that's no longer valid, while the real integration breaks in production. A smart approach is now actually implemented in CopilotKit🪁's recently open-sourced aimock project. Every day, the repo's own CI sends a handful of requests to the real API and the same requests to the fake server, then compares both against the official client library's type definitions. Those are the only real API calls in the whole setup, and they run on the repo's own keys, not in anyone else's CI. A single team can push hundreds of commits a day, and thousands of teams are already doing that with coding agents. All of those runs stay offline, because one repo checks against the real API on everyone's behalf. When a check fails, a coding agent updates aimock's built-in response schema, the full test suite has to pass, and a patch version ships to npm. By simply upgrading the package, the corrected schema gets reflected in every project using it. The capability is not just limited to a single provider. The same server works for Claude, OpenAI, Gemini, Bedrock, Azure, Ollama, plus MCP tools, A2A agents, AG-UI event streams, vector DBs like Pinecone and Qdrant, and search, speech, image, and video endpoints. Here's the repo: (don't forget to star it ⭐) That said, mocking your API calls is one thing. AI engineers should also know how to test agents properly in the first place, which several teams still skip. I wrote a full walkthrough on that, covering build, testing, evals, tracing, and deployment. Read it below.

Akshay 🚀

62,821 次观看 • 1 个月前

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.

Santiago

20,971 次观看 • 1 个月前