Which of these is a recommended security hardening practice for GitHub Actions workflows?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Least privilege is the bedrock security principle — a GITHUB_TOKEN that can only do what it needs limits blast radius if something goes wrong.
Full explanation below image
Full Explanation
GitHub's security hardening guide recommends: (1) Minimizing GITHUB_TOKEN permissions using 'permissions:' blocks; (2) Pinning third-party actions to full commit SHAs; (3) Protecting against script injection by using environment variables for untrusted data; (4) Using OIDC for cloud authentication instead of stored credentials; (5) Enabling secret scanning and push protection; (6) Reviewing Dependabot alerts for actions. Granting broad permissions 'for convenience' is explicitly an anti-pattern. Storing secrets in YAML exposes them in the repository. Self-hosted runners have their own security considerations and aren't universally more secure.