How to secure GitHub Actions?

Question

Accepted Answer

**Practices:**

**1. Minimal permissions:**
```yaml
permissions:
  contents: read
  packages: write
  id-token: write
```

**2. Version pinning:**
```yaml
# BAD
- uses: actions/checkout@master
# GOOD (SHA)
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
```

**3. OIDC instead of static keys:**
```yaml
permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123:role/github-actions
      aws-region: us-east-1
```

**4. Supply chain attack protection:** verified actions, CODEOWNERS for workflows.

DevOps: How to secure GitHub Actions?