Security
Are snapshot runners safe for public repositories?
Quick answer
Only if snapshots are taken from trusted branches and never from fork pull requests.
The detail that matters
A snapshot written by untrusted code is a persistent foothold. Restrict snapshot creation to protected branches.
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How do I generate an SBOM?Enable buildx's sbom: true output, or run syft against the built image.How do I attach build provenance?Use actions/attest-build-provenance, or buildx's provenance: true attestation.How do I pass secrets into a Docker build?Use BuildKit build secrets with --secret, never ARG or ENV.Are GitHub Actions runners secure?GitHub-hosted and reputable managed runners are ephemeral single-use VMs, which is the right isolation model.