Pipeline Credential Scope
also called OIDC Federation for CI, Workload Identity for CI
Granting a pipeline short-lived, narrowly scoped identity for exactly the environment it is deploying to, rather than a long-lived key.
CI systems are among the highest-value targets in an engineering estate, because a build server with deployment credentials is, functionally, production access with weaker controls and far more people able to trigger it. Several of the most damaging supply-chain compromises of recent years ran through exactly this path.
The long-lived static credential stored as a CI variable is the pattern to eliminate. It does not expire, it is readable by anyone who can modify the pipeline definition, it is exfiltrated by a single malicious dependency in a build step, and its use is indistinguishable from legitimate deployment in cloud audit logs.
The replacement is workload identity federation: the CI platform mints a signed token asserting the repository, branch and workflow, and the cloud provider exchanges it for short-lived credentials under a trust policy that names those exact claims. Nothing is stored. The token expires in minutes.
The detail people get wrong is the trust policy's subject condition. A policy that trusts the whole organisation rather than a specific repository and branch is a production credential available to any fork or feature branch, which quietly undoes the entire exercise.