CI for a utility-billing image currently COPY’s a database password into a layer “just for tests.” What is the sound testing posture?
Select an answer to reveal the explanation.
Short Explanation
Twelve-factor config applies to the test run too. Passwords and tokens come from the environment or Vault—not from a COPY’d layer that will fail or leak in the next tenancy.
Full Explanation
Test runs should follow the same externalized-config discipline as production. Connection strings and tokens come from the environment or from Vault in higher environments; they are not baked into image layers for convenience. A suite that only passes because a password sits in a layer will fail or leak when the image moves to another tenancy.