GitHub Actions · Workflow security review
GitHub Actions Security Review Checklist
A review template for workflow triggers, token permissions, untrusted inputs, third-party actions, environments, OIDC and artifact boundaries.
How to use this template
1
Review the workflow at the commit that will execute.
2
Trace data from pull requests and issues into shell, expressions and actions.
3
Treat runners and artifacts as security boundaries.
Copyable template
# GitHub Actions security review ## Trigger and trust - [ ] Workflow events and branch filters are intentionally scoped - [ ] pull_request_target does not execute untrusted checkout code - [ ] Fork and first-time contributor behaviour is understood - [ ] Environment approvals protect privileged deployment jobs ## Permissions and credentials - [ ] GITHUB_TOKEN permissions are explicit and least privilege - [ ] OIDC trust restricts repository, ref or environment and audience - [ ] Long-lived cloud credentials are not stored when federation is available - [ ] Secrets are unavailable to untrusted steps and are masked in logs ## Dependencies and execution - [ ] Third-party actions are pinned to reviewed commit SHAs - [ ] Untrusted values are passed through environment variables, not interpolated into scripts - [ ] Self-hosted runner exposure and persistence are documented - [ ] Build scripts cannot overwrite privileged workflow files during the job ## Outputs - [ ] Artifact upload and download boundaries are explicit - [ ] Deployment uses immutable artifact identities - [ ] Provenance or attestations are generated and verified where required - [ ] Workflow logs provide attributable audit evidence without secrets
Related KBY resources
Engineering signal
Follow GitHub Actions failures and fixes
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.