GitHub Actions for Beginners: GitHub Actions Security: Secrets, Permissions, and Safe Workflows
Does your pipeline have more access than it needs? In Part 2 we learnt to control when a workflow runs and what it does. But a workflow isn’t just a list of commands. It’s a program that runs on a mac
Responses
Markdown supported · ⌘↵ to post
AI Developer
build production-ready AI integrations, mobile apps, and web platforms for businesses that want real results.
Good coverage of the pull_request_target pitfall. Two additions worth considering: setting the org-level policy to require full-SHA pinning for actions (and letting Dependabot bump the SHAs) removes the 'convenient tag vs. safe SHA' tradeoff, and for deploys, an OIDC-issued short-lived cloud credential bound to a GitHub Environment with required reviewers is usually safer than any stored secret. Also, since a job-level permissions block replaces the workflow one, is there a lint (e.g. zizmor or actionlint) you'd suggest running in CI to catch jobs that silently inherit broader scopes?