Skip to content
Latchkey LogoLatchkey home
EnglishPortuguês日本語
Start Free

Latchkey Learn

CI security for GitHub Actions

How GitHub Actions workflows get attacked and the settings that stop it: pinned actions, least-privilege tokens, OIDC and untrusted input.

Start here four stops, in order

  1. 01GitHub Actions cache poisoningSupply chain
  2. 02GITHUB_TOKEN permissionsTokens and credentials
  3. 03Script injection in run: stepsUntrusted input
  4. 04GitHub Actions permissions builderTools

Contents 4 sections · 9 entries

Tokens and credentials 2 entries

GITHUB_TOKEN permissions, OIDC.

  1. 2.1GITHUB_TOKEN permissions
  2. 2.2OIDC cloud credentials, done tightly

Untrusted input 3 entries

pull_request_target, script and prompt injection.

  1. 3.1Script injection in run: steps
  2. 3.2Prompt injection in CI agents
  3. 3.3pull_request_target and pwn requests

Tools 1 entry

Free tools that run in your browser.

  1. 4.1GitHub Actions permissions builder
Explore other topics
GitHub Actions runners comparedEvery managed runner vendor, priced and benchmarked side by side. GitHub Actions costWhat Actions really costs, and how to cut it. Runner failures Latchkey repairsOut of memory, disk full, rate limits, lost runners: reproduced and fixed. GitHub Actions workflow errorsWorkflow, YAML, permissions and artifact errors, diagnosed and fixed. Docker in CI: Registry, Build & RuntimeRegistry, runtime and build errors on CI runners. Faster GitHub ActionsCaching, parallelism and cold starts, measured.