title: Storing sensitive information in git/travis workflows
body: <p>I am using Github as the repository for a package I am building. At the moment I have a <code>.travis.yml</code> file setup that helps with automatically testing the code as it is pushed in. Eventually I'd like to deploy the package to a service like <a href="https://pypi.python.org" rel="nofollow">PyPI</a>) but the language and package manager a re unimportant to the question).</p>
  
  <p><a href="http://docs.travis-ci.com/user/deployment/pypi/" rel="nofollow">Reading the documentation shows that its relatively easy to do this automatically:</a></p>
  
  <blockquote>
    <p>For a minimal configuration, all you need to do is add the following
    to your .travis.yml:</p>
  
  <pre><code>deploy:
    provider: pypi
    user: "Your username"
    password: "Your password"
  </code></pre>
  </blockquote>
  
  <p>Except for the relatively small hitch that <strong><em>I'd need to put the username and password for PyPI into a publically visible yaml file</em></strong>.</p>
  
  <p>Obviously this is bad practice, and I'm sure there are ways around this via tokens or something, but googling shows <a href="http://peterdowns.com/posts/first-time-with-pypi.html" rel="nofollow">lots of suggestions</a> <a href="https://github.com/mrtazz/simplenote.py/blob/master/.travis.yml" rel="nofollow">along the same lines</a> of "put your password here".</p>
  
  <p>Am I missing something here? Or are people just putting their authentication keys into publicly visible files?</p>