Local Build vs CI/CD Pipeline for Jekyll Secret Management

Answer

For Jekyll, a CI/CD pipeline that uses protected, masked environment variables offers a more sustainable least‑privilege model for managing build‑time secrets.

Confirmed facts

• Jekyll reads environment variables at build time; secrets must be supplied as env vars (or temporary files) during jekyll build.
• If a secret is interpolated into a Liquid template, it will appear in the generated HTML.
• Local builds keep secrets on the developer’s machine, which relies on individual hygiene and .gitignore hygiene.
• Most CI systems (GitHub Actions, GitLab CI, etc.) mask protected variables in job logs by default.

Likely explanation

Storing secrets in a CI system centralises access control, limits exposure to a single trusted runner, and provides audit‑able masking. A local build spreads the secret to every developer’s workstation and depends on each person to avoid accidental commits, which is harder to enforce at scale.

Steps for a CI/CD flow (GitHub Actions example)

1. Add each secret (e.g., API_KEY) as a repository secret Settings → Secrets → Actions.
2. In the workflow file, reference the secret and export it as an environment variable for the Jekyll job:

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      API_KEY: ${{ secrets.API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.2'
      - name: Install dependencies
        run: bundle install
      - name: Build Jekyll site
        run: JEKYLL_ENV=production bundle exec jekyll build

1. Ensure the workflow does not echo or print the variable; avoid echo $API_KEY or similar debug commands.
2. After a run, inspect the job log and confirm that the secret appears only as masked values (***).
3. Verify that the generated _site directory does not contain the secret string (e.g., grep -r \"API_KEY\" _site returns no matches).
4. Double‑check that any .env file is listed in .gitignore and run git check-ignore -v .env to confirm it is ignored.

Missing diagnostic detail

Do any of your Jekyll layouts, includes, or plugins output build‑time environment variables directly into the HTML (e.g., {{ site.api_key }})? If yes, you must audit and remove those references before relying on CI secret masking.