Carlos Florêncio
28 lines
1.6 KiB
Markdown
28 lines
1.6 KiB
Markdown
# GitHub Actions security
|
|
|
|
Apply this guidance whenever editing `.github/**`.
|
|
|
|
- `issue_comment` and `pull_request_target` jobs execute the workflow from the
|
|
trusted default/base branch. Syncing a PR does not change an existing
|
|
comment-triggered run.
|
|
- Never check out or execute an untrusted PR head in a secret-bearing or
|
|
comment-triggered job before a privileged agent or action. Keep the default
|
|
branch checkout, use `persist-credentials: false`, and treat PR metadata,
|
|
diffs, and files as untrusted data.
|
|
- Constrain capabilities in the tool policy, not prompt text alone. For PR-file
|
|
reads, prefer a small GET-only helper bound to the event PR/head; validate
|
|
normalized repository-relative paths, regular-file type, response path,
|
|
size, encoding, and content. Do not grant generic `gh api`, arbitrary
|
|
interpreters, or broad Bash merely to read PR files.
|
|
- PR label/metadata cleanup jobs that operate on pull requests must declare
|
|
`pull-requests: write`, not `issues: write`; mirror the permission shape used
|
|
by `preview-env.yml`.
|
|
- Release workflow changes must trace prepare/summary outputs and conditions
|
|
through every build and publication job: skip decisions must propagate
|
|
without accidental publishing, while backfill must reuse and validate the
|
|
existing tag and still run its required build/publication path. Verify each
|
|
actual publication job and artifact, not only the aggregate workflow result.
|
|
- For workflow security changes, run the relevant raw workflow-contract tests,
|
|
`python3 .github/scripts/lint-action-pinning_test.py`, `zizmor .github/workflows`,
|
|
and `git diff --check`.
|