github-actions-security-cheat-sheet

What problem does it solve?

The GitHub Actions Security Cheat Sheet provides a concise, ready-to-use reference of proven security patterns to harden workflows, reducing misconfigurations and security debt.

Core Features & Use Cases

• Action pinning guidance: Learn to pin actions to immutable SHAs and include version comments to prevent supply chain drift.
• Minimal permissions and secrets best practices: Enforce minimal workflow and job permissions, use OIDC where possible, and avoid storing credentials.
• Runner hardening and workflow hardening patterns: Apply safe runner configurations and workflow-level protections to reduce blast radius.
• Use cases include securing CI/CD pipelines across teams, onboarding new repos with security baselines, and auditing existing workflows for compliance.

Quick Start

Open the cheat sheet and start by pinning actions to SHA sums and setting minimal permissions in your workflows.