github-actions-security-cheat-sheet

To secure GitHub Actions workflows, apply patterns like pinning actions to immutable SHAs, enforcing minimal job permissions, using OIDC for cloud access, and hardening runners to reduce your pipeline's blast radius.

Pinning GitHub Actions to an immutable SHA prevents supply chain drift by ensuring the action's code cannot be silently updated, and adding a version comment helps track the pinned release for maintainability.

Using OIDC in CI/CD pipelines lets you request short-lived tokens directly from your cloud provider instead of storing long-lived credentials as GitHub secrets, minimizing credential exposure and access risk.

Yes, you can audit existing GitHub Actions workflows for compliance by checking them against security patterns like minimal permissions, action pinning, OIDC usage, and safe runner configurations to identify misconfigurations.

GitHub Actions secret management best practices include enforcing minimal workflow permissions, avoiding stored credentials by using OIDC where possible, and restricting secret access to only the jobs that require them.

You should apply workflow hardening patterns when onboarding new repositories with security baselines, securing CI/CD pipelines across teams, or reducing the blast radius of compromised runners in production environments.