Which two practices harden GitHub Actions against secret exposure and untrusted automation? (Choose two.)
Select all correct answers, then click Submit.
Short Explanation and Infographic
OIDC beats long-lived static cloud keys, and environment protection rules gate production deploys. Public root keys and blanket write tokens are the opposite of hardening—never do those.
Full explanation below image
Full Explanation
Modern hardening combines short-lived cloud credentials via OIDC, least-privilege GITHUB_TOKEN permissions per job, environment protection rules for production, avoidance of script injection, SHA-pinned actions, and careful pull_request_target use. Repository variables are not secret storage—placing root keys there, especially in public repos, is catastrophic. Over-scoping GITHUB_TOKEN increases blast radius if a workflow is compromised. Additional controls include secret scanning push protection, audited runner groups, disabling self-hosted runners for untrusted forks, and dependency review. Treat CI as production infrastructure.