How to Secure Your GitHub Actions in 5 Minutes: A Step-by-Step Guide

How to Secure Your GitHub Actions in 5 Minutes: A Step-by-Step Guide You've got 100 workflows running across your org. Someone's bound to use pull_request_target without restrictions. Someone else hardcoded secrets. And nobody's checking permissions. This article shows you exactly what to fix — right now, in under 5 minutes. The 5-Minute Security Checklist 1. Lock Down Pull Request Workflows (2 minutes) The biggest GitHub Actions vulnerability is using pull_request_target with untrusted code. Bad: on : pull_request_target jobs : test : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 with : ref : ${{ github.event.pull_request.head.sha }} - run : npm test This checks out fork code and runs it with your secrets. Disaster. Good: on : pull_request : types : [ opened , synchronize ] jobs : test : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 - run : npm test Regular pull_request checks out your repo code, not the fork. Safe. If you MUST use pull_request_target : o