GitHub Actions · Workflow security review
GitHub Actions Security Review Checklist
A review template for workflow triggers, token permissions, untrusted inputs, third-party actions, environments, OIDC and artifact boundaries.
Choose the right control
Use this template when
- A workflow gains write permissions, secrets, deployment authority or untrusted triggers.
- A repository adopts third-party actions, self-hosted runners or cloud OIDC federation.
Use another workflow when
- The workflow only performs an unprivileged local lint with no artifacts or external credentials.
- You are responding to an active workflow compromise and need incident containment first.
Before you start
Collect these inputs before review so unchecked controls become evidence-backed decisions rather than placeholders.
The workflow and referenced actions at immutable commits
Repository, environment and organisation policy settings
Expected trust boundaries for contributors, runners and artifacts
How to use this template
1
Review the workflow at the commit that will execute.
2
Trace data from pull requests and issues into shell, expressions and actions.
3
Treat runners and artifacts as security boundaries.
Copyable template
# GitHub Actions security review ## Trigger and trust - [ ] Workflow events and branch filters are intentionally scoped - [ ] pull_request_target does not execute untrusted checkout code - [ ] Fork and first-time contributor behaviour is understood - [ ] Environment approvals protect privileged deployment jobs ## Permissions and credentials - [ ] GITHUB_TOKEN permissions are explicit and least privilege - [ ] OIDC trust restricts repository, ref or environment and audience - [ ] Long-lived cloud credentials are not stored when federation is available - [ ] Secrets are unavailable to untrusted steps and are masked in logs ## Dependencies and execution - [ ] Third-party actions are pinned to reviewed commit SHAs - [ ] Untrusted values are passed through environment variables, not interpolated into scripts - [ ] Self-hosted runner exposure and persistence are documented - [ ] Build scripts cannot overwrite privileged workflow files during the job ## Outputs - [ ] Artifact upload and download boundaries are explicit - [ ] Deployment uses immutable artifact identities - [ ] Provenance or attestations are generated and verified where required - [ ] Workflow logs provide attributable audit evidence without secrets
Evidence to retain
Review record
- Effective GITHUB_TOKEN permissions by job
- Pinned action revisions and provenance checks
- Negative tests for untrusted input, fork and environment approval paths
Definition of done
Acceptance criteria
- Untrusted contributors cannot reach privileged credentials or execution paths.
- Third-party code and deployment artifacts have immutable identities.
- Every privileged job has explicit permissions, ownership and audit evidence.
Worked adaptation
Apply it to a real change
A public repository deploys to AWS after environment approval. Reviewers need to prove that a forked pull request cannot execute repository code with the production OIDC identity.
- Separate pull-request validation from the protected deployment workflow.
- Pin all actions to reviewed commit SHAs.
- Record the environment approval and AWS subject-condition tests.
Related KBY resources
Engineering signal
Follow GitHub Actions failures and fixes
A useful digest about twice a week with new error references, tools, integration notes and production lessons. No daily noise.