<p>I have a private project on Gitlab with CI/CD set up to push/pull docker images from Google Container Registry and to deploy my software to Kubernetes Engine in GCP. </p>

<p>Is there a way to make my project public without worrying about the secrets used to connect to GCP getting leaked? In particular, I'm worried that when my repository is public anyone would be able to add a line like <code>echo $GCP_REPOSITORY_SECRET</code> somewhere in the <code>.gitlab-ci.yml</code> file, push their branch and view the output of the CI to "discover" my secret. Does Gitlab have a mechanism to prevent this? More fundamentally, are there best practices to keep deployment secrets secret for public repositories?</p>

<p>Masked variables are ridiculously easy to unmask...</p>

<pre class="lang-sh prettyprint-override"><code>echo ${MASKED_VARIABLE::1} ${MASKED_VARIABLE:1} // mind the gap \!
</code></pre>

<p>You may want to <em>PROTECT</em> them instead;
AND, make sure that only truly trusted devs can push to your protected branches.</p>
