GitHub Actions Best Practices
summary
Concrete checks not platitudes: require branch protection and signed commits, store secrets at environment level instead of org-wide, and rotate tokens regularly. Configure workflows with use specific SHA for third‑party actions, restrict GITHUB_TOKEN to read and grant wider scopes per job using the actions permission monitor, and require approval for outside collaborators. Demo shows GitHub co-pilot workspaces generating workflows and PRs (build matrix node 18 + 20, stale-branch cleanup) and it works as a quick PoC.
AI-written summary · about
chapters (12)
- 0:00GitHub Actions best practices
- 3:54Organizing teams for security
- 6:47Branch protection rules
- 8:30Trusted actions with SHAs
- 10:58Auditing third-party actions
- 12:45Securing collaborator access
- 13:47Least privilege for tokens
- 16:14Managing environment secrets
- 18:15Migrating to fine-grained tokens
- 21:47Monitoring action permissions
- 23:53Demo: Copilot for Actions
- 35:00Q&A
related talks
57mGitHub Actions: A Cloudy Day for Security
56mHow to use GitHub Actions with Security in mind
45mGitHub Actions & Security
01h 47mDeveloper Workflow Automation with GitHub Actions
51mHow to secure your GitHub Actions
30mSpend More Time Coding & Automate the Boring Stuff
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
36mGitHub Actions: Open Source Workflow Automation