New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security hardening for GH actions workflows #3671

Open

3 tasks

musicEnfanthen opened this issue May 7, 2024 · 2 comments

Open

3 tasks

Security hardening for GH actions workflows #3671

musicEnfanthen opened this issue May 7, 2024 · 2 comments

Labels

documentation / test suite low priority

Contributor

musicEnfanthen commented May 7, 2024 •

edited by lpugin

Loading

To harden the security of the GitHub action workflow runners, there are multiple steps to consider:

pin actions to a full length commit SHA (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
should be combined with automatic updates, e.g. with Dependabot (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-dependabot-version-updates-to-keep-actions-up-to-date)
restrict token permissions to minimum needed (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#restricting-permissions-for-tokens)

Contributor Author

musicEnfanthen commented May 7, 2024

Just leaving this here for future reference.

Contributor

lpugin commented Sep 12, 2024

@musicEnfanthen I re-formatted you initial comment. Please double check that it is three points and not two

lpugin added documentation / test suite low priority labels

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment