How to use GitHub Actions with Security in mind
summary
Covers concrete risks and fixes for GitHub Actions: the marketplace has 12,500+ public actions that runners download wholesale, self-hosted runners can exfiltrate secrets and traverse internal networks, and secrets are injected as plaintext into runner processes where GitHub’s redaction regex can fail. Recommends OIDC for cloud auth, scoping the default GitHub token, pinning by commit SHA, using Dependabot-like checks, and running a fork-and-verify workflow with automated fork-updater to keep vetted action forks current.
AI-written summary · about
chapters (33)
- 0:00Intro
- 1:12What are GitHub workflows?
- 2:23What are GitHub Actions?
- 3:50Workflow example
- 6:42Repository security
- 6:53Code - Who has access?
- 8:32Configuring access
- 8:51From the user
- 10:03Workflow secrets
- 11:42Who has access to your secrets?
- 18:33Your code - Best practices
- 21:08GitHub Actions Security
- 24:04Best practice: Run the action inside of a container
- 26:19Persisting data between runs
- 28:05Workflow runners - Best practice
- 34:08Verified Creator
- 35:08Protective measures
- 38:51Recommendation
- 39:31Workflow attack vectors
- 39:50Forks of public repos
- 41:18Pull Requests
- 43:04Common fields
- 44:05Remediation
- 44:38Forking actions
- 47:07Staying up to date
- 47:49Update action versions
- 48:09Option 1: Use SHA+Dependabot
- 49:31Use Dependabot
- 50:38Keep your forked action up to date
- 52:00Review before merging
- 52:22Automation
- 52:55Pros of forking
- 54:12Best practices summarized
related talks
51mHow to secure your GitHub Actions
45mGitHub Actions & Security
15mGitHub Actions: a time bomb for supply chain security
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
57mGitHub Actions: A Cloudy Day for Security
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
41mSecuring Self-Hosted GitHub Actions with Kubernetes & Actions-Runner-Controller
23mBreaking the Build: How Attackers Abuse GitHub Actions