guides
A GitHub Actions security checklist that is actually short
Five changes that remove most of the realistic risk in a typical Actions setup.
Jess Okonkwo · Co-founder · 2026-02-04 · 6 min read
Most Actions security advice is long enough that nobody finishes it. These five changes remove the majority of realistic risk.
- Set the organisation-wide default GITHUB_TOKEN permission to read-only, and elevate per job
- Pin third-party actions to a full commit SHA — a tag can be moved under you
- Replace stored cloud credentials with OIDC so there is nothing durable to steal
- Audit every use of pull_request_target; it runs with write access in the base repository's context
- Scope production secrets to a deployment environment with required reviewers
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
CI when your teammates are agentsAI coding agents push far more often than humans. Here is how that changes pipeline design and cost control.Why we publish instructions for leavingEvery migration page on this site includes the diff to migrate back off us. Here is the reasoning.What we learned running a million CI jobsQueue time, cache behaviour, right-sizing and the failure modes that only appear at scale.Stop retrying flaky testsAutomatic retries convert a real bug into an intermittent one, and train your team to distrust every failure.