GitHub Actions

GitHub Actions runs YAML workflows on hosted or self-hosted runners, triggered by repository events. Security hinges on pinning third-party actions, minimal GITHUB_TOKEN permissions and OIDC for cloud access.

Stage

Build

What it does

Executes jobs defined in .github/workflows/*.yml with reusable steps from the marketplace.

Where it fits

Build stage for GitHub-hosted projects.

Quick start

permissions:
  contents: read
  id-token: write # OIDC to cloud providers, no long-lived keys
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<full-commit-sha>
      - uses: aquasecurity/trivy-action@<full-commit-sha>
        with: { scan-type: fs, exit-code: '1', severity: 'HIGH,CRITICAL' }

Common pitfalls

Actions referenced by tag can be retargeted; pin to a full commit SHA.
pull_request_target with checkout of the PR head executes untrusted code with secrets.
Default GITHUB_TOKEN permissions are too broad; set permissions: per workflow.

What it does#

Where it fits#

Quick start#

Common pitfalls#

What it does

Where it fits

Quick start

Common pitfalls