Guides
How to secure your CI supply chain
Third-party actions run with access to your repository and secrets.
6 min read
Third-party actions run with access to your repository and secrets.
Why it happens
Actions referenced by tag can be changed under you; a compromised action sees everything the job does.
How to fix it
- Pin third-party actions to a full commit SHA, not a tag
- Restrict which actions may run at the organisation level
- Use default-deny egress so a compromised step cannot exfiltrate
- Generate provenance attestations so consumers can verify build origin
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to manage secrets in GitHub ActionsSecrets are sprawled across repository settings and nobody knows what is still used.How to run CI runners inside your VPCBuilds need to reach an internal service that is not exposed publicly.How to give runners a static IPA third-party service requires IP allowlisting and hosted runner IPs change constantly.How to run security scans without slowing CIVulnerability scanning adds minutes to every pull request.