github-actions-security

GitHub Actions Security

GitHub Actions runs code with access to your secrets, your code, and increasingly your cloud accounts. Most teams ship workflows with the defaults, which are convenient but expose more than necessary. This skill is the working baseline for production-grade Actions usage.

When to invoke

• Adding a new workflow
• Introducing a third-party action (uses: someone/some-action@v1)
• A workflow leaked a secret (cleanup + prevention)
• Migrating from long-lived cloud credentials to OIDC
• Periodic audit of .github/workflows/
• Inheriting a repo with unfamiliar workflows

Rule 1 — Pin third-party actions to commit SHA

uses: someone/action@v1 looks safe. It's not. Tags and branches can be moved at any time. If the action's maintainer is compromised, every workflow using @v1 runs the new attacker code on next CI.

Pin to a commit SHA. Comment the version for readability:

# Bad
- uses: actions/checkout@v4

# Good
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

For your own org / first-party actions, tag pinning is acceptable because you control the tag. For external actions: SHA pin.

dependabot can update SHA pins automatically — turn it on for .github/workflows/:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule: { interval: weekly }

Rule 2 — Scope GITHUB_TOKEN permissions

GITHUB_TOKEN is created per workflow run. Its default permissions are broad — write to repo contents, issues, PRs, packages. Most workflows need read.

Set the floor at the workflow level, raise per-job only when needed:

name: CI

# Workflow-level default — read-only
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    # inherits read-only
    steps:
      - uses: actions/checkout@<sha>
      - run: npm test

  release:
    runs-on: ubuntu-latest
    needs: test
    # Raise only for this job
    permissions:
      contents: write           # for creating tags/releases
      packages: write           # for publishing
    steps:
      - uses: actions/checkout@<sha>
      - run: npm publish