# GitHub Actions security review

## Trigger and trust
- [ ] Workflow events and branch filters are intentionally scoped
- [ ] pull_request_target does not execute untrusted checkout code
- [ ] Fork and first-time contributor behaviour is understood
- [ ] Environment approvals protect privileged deployment jobs

## Permissions and credentials
- [ ] GITHUB_TOKEN permissions are explicit and least privilege
- [ ] OIDC trust restricts repository, ref or environment and audience
- [ ] Long-lived cloud credentials are not stored when federation is available
- [ ] Secrets are unavailable to untrusted steps and are masked in logs

## Dependencies and execution
- [ ] Third-party actions are pinned to reviewed commit SHAs
- [ ] Untrusted values are passed through environment variables, not interpolated into scripts
- [ ] Self-hosted runner exposure and persistence are documented
- [ ] Build scripts cannot overwrite privileged workflow files during the job

## Outputs
- [ ] Artifact upload and download boundaries are explicit
- [ ] Deployment uses immutable artifact identities
- [ ] Provenance or attestations are generated and verified where required
- [ ] Workflow logs provide attributable audit evidence without secrets