secure-github-action

To secure GitHub Actions workflows, you pin all action references to full commit SHAs instead of mutable tags or branches. This prevents supply-chain risks by ensuring the workflow always runs the exact, auditable code version you expect.

You should avoid the pull_request_target trigger for privileged operations because it runs with write access to the repository. Using it with untrusted code can lead to script injection, so safer checkout practices and controlled run contexts are enforced instead.

Best practices for minimal permissions in GitHub Actions involve explicitly setting least-privilege access at both the workflow and job levels. This limits the blast radius of potential security breaches by restricting what the automated process can modify.

You prevent script injection in GitHub Actions by using safe environment variables and avoiding risky contexts for untrusted inputs. Hardening the checkout process and controlling run contexts ensures that malicious pull requests cannot execute arbitrary commands.

Yes, this approach is designed for teams migrating sensitive CI pipelines to enforce security standards across multiple repositories. It provides validated, auditable workflow configurations that apply supply-chain security practices uniformly.

Hardening checkout in GitHub Actions involves configuring safe environment usage and controlled run contexts during repository cloning. This prevents unsafe script injection and ensures the workflow operates within a secure, minimal permission scope.