What's changed: New GH-200 Chapter 5 (security best practices = script-injection mitigation, GITHUB_TOKEN least privilege vs PAT, OIDC cloud federation, SHA pinning/trustworthy actions/usage policies, attestations/provenance (SLSA), environment approval gates; performance/cost optimization = actions/cache, retention (REST API), matrix size/max-parallel, concurrency+cancel-in-progress, paths/branches filters, if conditions, runner sizing)
5.1Security Best Practices
Understand mitigating script injection, the GITHUB_TOKEN lifecycle and least privilege vs PATs, OIDC for cloud federation (eliminating long-lived secrets), pinning third-party actions to SHAs and choosing trustworthy actions with usage policies, artifact attestations/provenance, and environment approval gates.
CI/CD touches source code, secrets, and production, making it a frequent attack target. GH-200’s final domain tests designing workflows securely. The guiding principles are least privilege, run only trusted code, and hold no long-lived secrets.
5.1.1Mitigating script injection
Script injection happens when untrusted input like a PR title, issue body, or branch name is embedded directly into a run: shell command—an attacker putting a malicious command in ${{ github.event.issue.title }} would have it executed on the runner. Mitigations: don’t expand untrusted values directly in run: (put them in an intermediate environment variable and use them quoted as "$VAR"), validate/sanitize inputs, grant least privilege, and prefer vetted actions over inline scripts where possible.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.