Securing your GitHub Actions
Now that you have learned how to create GitHub Actions workflows from scratch – and how to customize existing workflows templates – you have seen how the secrets context is often used within those workflows. Using secrets is the most important security practice you can adopt to keep your GitHub Actions features safe. However, there are other good practices that you should consider. This section will present the following best practices:
- Secrets – how to create and use them
- Securely adding third-party actions to your workflow
- Best practices for securing self-hosted runners
Let's look at these in more detail.
Secrets – how to create and use them
Secrets are encrypted environment variables that you can store at the repository, environment, or organization levels. Organization-level secrets are outside the scope of this book.
A brief overview
Except for the GITHUB_TOKEN secret – more...
