Writing GitHub Actions securely is notoriously difficult. While the default behavior is relatively secure, certain features may have nonobvious non-obvious security implications. As we

Threat model

We're increasingly exposing secrets to our GitHub Actions builds, it's worth carefully auditing that those secrets cannot be abused by third partiestrying to protect:

• For projects that trigger releases from GitHub Actions: the signing key material
• For all projects: prevent an attacker from 'sneaking in' a commit to the main branch without review
• Any credentials for 3rd-party services that might be configured

We mainly focus on attacks that can be triggered by external attackers, though ideally also compromised committer accounts should also be considered.

Default GITHUB_TOKEN permissions

Each build will have access to a GITHUB_TOKEN to perform GitHub API calls. The permissions associated with this token depend on the trigger that started the build. You can find an overview here. Tokens for workflows triggered by pull_request are safe, but others are not.

Builds triggered with pull_request_target 

...

Similarly, builds triggered with issue_comment  run with a 'permissive' GITHUB_TOKEN. Again, no code may be loaded after switching to the PR branch.

Builds triggered with on_workflow

A common technique for building untrusted code but also using privileges to act on the build result is to split the build into two parts: a low-privilege one triggered by pull_request that runs the untrusted code, stores the result in an artifact, and triggers a second, high-privilege build with on_workflow  that acts on that result.

In such a scenario, you must be careful to make sure all evaluation of untrusted code happens in the pull_request  build, and no untrusted code is executed in the on_workflow part of the workflow.

3rd-party actions

The Apache Infrastructure GitHub Actions Policy states actions outside of apache/*, github/* and actions/* must be pinned to the specific git hash (SHA1) of the action that has been reviewed for use by the project. For instance, you MUST pin foobar/baz-action@8843d7f92416211de9ebb963ff4ce28125932878.

...