github-actions-security

Prevent secret leaks in GitHub Actions by auditing secrets discipline, avoiding risky pull_request_target workflows that execute untrusted code, and scoping GITHUB_TOKEN permissions to limit privilege levels. Ensure sensitive data is protected from accidental exposure.

Secure cloud credentials in CI/CD pipelines by implementing OIDC Federation to establish short-lived, trusted cloud credentials. This approach replaces long-lived secrets with temporary tokens issued by your cloud provider.

Stop supply chain attacks from third-party GitHub Actions by pinning actions to specific commit SHAs instead of mutable tags. Review third-party actions for safety and maintenance status before adoption to ensure ongoing reliability.

Untrusted input injection in GitHub Actions happens through expression interpolation where user-controlled variables are evaluated unsafely. Detect and mitigate these attack vectors by validating inputs and avoiding direct interpolation in run scripts.

The limitation of pull_request_target in GitHub Actions is that it runs with privileged repository secrets and token access, making it risky when executing code from untrusted sources. Identify and avoid this misuse to prevent secret leaks.