A public-health lab pipeline must load staging credentials on feature branches and production credentials only on main. Which Git variable practice applies?
Select an answer to reveal the explanation.
Short Explanation
Use the branch name to pick staging keys on feature branches and production keys only on main. That way, you don't hand production secrets to feature builds.
Full Explanation
Git branch variables let continuous-integration pipelines choose environment-specific configuration from the checked-out branch name. In a public-health lab pipeline, feature branches should resolve staging credentials and only main (or an equivalently protected release branch) should resolve production credentials. Reading the branch variable and mapping it to the correct vault path or environment block is how continuous-integration keeps staging and production secrets separated without manual pasting. That practice matches how municipal and public-health teams gate dangerous credentials: the branch is the authoritative signal for which counter—staging or production—the job is serving.
Using the Git commit message variable to choose staging or production credential paths fails because commit messages are not a reliable environment selector; they can be edited, reused, or mismatched with the branch that actually runs the job. Hard-coding production vault paths into every branch job fails by concept because every feature build then pulls live production secrets. Broken experiments on feature branches can leak or misuse production credentials even though the change never reached main. Ignoring the branch name and always injecting production secrets fails for the same reason: convenience collapses environment isolation and turns every continuous-integration run into a production-secret consumer. Deleting all environment variables so operators paste secrets into chat fails because secrets leave the vault boundary, land in chat history, and cannot be rotated or audited as pipeline-managed credentials.
Exam caveat: branch-based selection is necessary but not sufficient by itself. Production secret injection still needs protected branches, restricted runners, and vault policies so a renamed or forged branch cannot casually obtain production material. Do not confuse reading the branch variable with trusting any branch string from an untrusted fork without additional controls.
Operational check: push a feature branch and confirm the job resolves only staging paths; merge or push to main and confirm production paths appear only there. Inspect the job log metadata (not secret values) for the selected environment label, and verify a feature-branch run cannot read the production vault path.