github-actions-securitylisted

# GitHub Actions Security GitHub Actions runs code with access to your secrets, your code, and increasingly your cloud accounts. Most teams ship workflows with the defaults, which are convenient but expose more than necessary. This skill is the working baseline for production-grade Actions usage. ## When to invoke - Adding a new workflow - Introducing a third-party action (`uses: someone/some-action@v1`) - A workflow leaked a secret (cleanup + prevention) - Migrating from long-lived cloud credentials to OIDC - Periodic audit of `.github/workflows/` - Inheriting a repo with unfamiliar workflows ## Rule 1 — Pin third-party actions to commit SHA `uses: someone/action@v1` looks safe. It's not. Tags and branches can be moved at any time. If the action's maintainer is compromised, every workflow using `@v1` runs the new attacker code on next CI. **Pin to a commit SHA.** Comment the version for readability: ```yaml # Bad - uses: actions/checkout@v4 # Good - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 ``` For your own org / first-party actions, tag pinning is acceptable because you control the tag. For external actions: SHA pin. `dependabot` can update SHA pins automatically — turn it on for `.github/workflows/`: ```yaml # .github/dependabot.yml version: 2 updates: - package-ecosystem: github-actions directory: / schedule: { interval: weekly } ``` ## Rule 2 — Scope `GITHUB_TOKEN` permissions `GITHUB_TOKEN` is created per workflow ru