Secure the pipeline
Pin and review actions
Treat third-party actions as dependencies that execute with the job’s workspace, network, and credentials.
A GitHub Action is code that runs inside your job. It can read the workspace, use the network, and use the job token. Treat third-party actions like npm dependencies with supply-chain risk.
uses: some-org/deploy@v3 looks harmless. That tag can move. Tomorrow @v3 might point at different commits.
Malicious or compromised actions have exfiltrated secrets from real repositories. Pinning does not remove review, but it stops silent tag movement.
Pin immutable commits
Prefer a full commit SHA:
- uses: actions/checkout@11bd71901bbe5b1635ceea93d275ad9742e878aGitHub documents those SHAs on popular actions. When you update, read the release notes, bump the SHA, and run CI.
For your own composite actions, pin them the same way.
Review before you trust
Before adding an action, check:
- who maintains it
- when it was last updated
- what permissions it requests
- whether you could replace it with a ten-line
run:step
Fewer dependencies means fewer surprise updates.
Document your action inventory
Make a table for the team:
| Action | Pin | Maintainer | Permissions needed | Update process |
|---|---|---|---|---|
| actions/checkout | SHA… | GitHub | contents: read | monthly Dependabot |
| aws-actions/configure-aws-credentials | SHA… | AWS | id-token: write | on CVE notice |
Hand that table to a teammate. They should understand what runs on every push without a verbal tour.
Dependabot can bump action SHAs on a schedule. Pair automated bumps with a required CI pass before merge.
Try this on your own project: replace one floating @v4 tag with a commit SHA and note which workflows still pass.
Lesson completed