To reduce supply-chain risk in GitHub Actions, pin each action to a verified full-length commit SHA, give each job only the GITHUB_TOKEN permissions it needs, and use OIDC with restrictive cloud-side trust instead of stored long-lived cloud credentials. These controls address different risks: a SHA fixes which action code runs, token permissions limit what that code can do in GitHub, and OIDC trust rules determine whether a workflow can obtain cloud access.
What can go wrong in a GitHub Actions workflow?
A workflow is not just automation configuration. Every action it runs is code executing with access to the job’s workspace, data, and available credentials. That includes third-party actions and actions from your own organization. If an action is compromised, overly broad, or simply behaves differently than expected, its access can turn a routine build or deployment into a route to repository or cloud resources.
As an Amazon Associate I earn from qualifying purchases.
- A version tag can be moved or deleted, changing the code a workflow runs without changing the workflow file.
- An action can use the job’s
GITHUB_TOKENpermissions even if the workflow did not explicitly pass the token as an input. - Secrets exposed to untrusted pull-request content or unreviewed actions can be misused.
- A cloud role that trusts an overly broad set of GitHub identities can let an unintended workflow obtain cloud credentials.
GitHub’s secure-use guidance recommends treating actions as code, auditing their behavior, and limiting the credentials and permissions available to them.
How do I pin GitHub Actions to a commit SHA?
Use the action’s full-length commit SHA in the uses reference. GitHub states: “Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release.” A tag such as @v4 is easier to read and maintain, but it is mutable; if the publisher’s repository is compromised, a tag could be moved or deleted. See GitHub’s secure-use reference.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Find and verify the SHA
- Open the action’s upstream repository and identify the exact release or revision you intend to use.
- Verify the full commit SHA against that repository. Do not copy a shortened SHA or assume a tag is equivalent to an immutable reference.
- Review the action’s source and how it handles repository files, inputs, tokens, and secrets. A pinned action can still contain unsafe or malicious code; pinning fixes the revision, not its trustworthiness.
- Use the verified SHA in the workflow’s
usesline. The general form isowner/repository@<full-commit-SHA>; replace the illustrative value with the upstream commit you verified.
For example, a workflow step should follow this pattern rather than relying on a movable tag:
steps:
- uses: actions/checkout@<full-commit-SHA>This is a format example, not a real SHA. Use the verified commit for the action you have selected.
Keep pinned actions maintained
Immutable does not mean permanently safe or current. Establish a regular update process, such as Dependabot or an equivalent review, to identify newer action revisions. Review proposed SHA changes and the associated upstream changes before merging them; an automated update is a prompt for review, not proof that the new code is safe.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I restrict GITHUB_TOKEN permissions?
Set permissions deliberately at workflow or job scope, starting from the minimum the workflow needs. GitHub identifies read-only repository contents as a good default. When a workflow declares permissions, grant only the scopes required; add any extra authority only to the job that needs it. GitHub’s GITHUB_TOKEN authentication guidance explains the available configuration.
Use job-level grants for different tasks
A test job may need repository read access, while a deployment job may also need permission to request an OIDC token. A workflow can express that separation like this:
name: build-and-deploy
permissions:
contents: read
jobs:
test:
permissions:
contents: read
steps:
- uses: actions/checkout@<full-commit-SHA>
- run: ./run-tests.sh
deploy:
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@<full-commit-SHA>
- run: ./deploy.shThe action references are illustrative and must be replaced with verified SHAs. Add other permission scopes only when a job’s task requires them, and document why they are needed. Keep a grant at workflow scope only when every job genuinely needs it; a job-level grant makes the intended boundary clearer and can reduce which steps receive authority.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Remember that actions can use the job token
Do not assume an action cannot access GITHUB_TOKEN because it was not supplied as an input. GitHub notes that an action can access the token through github.token. Review every action in a job as code running with that job’s accessible token permissions, and avoid placing unreviewed third-party actions in jobs with broad write access.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do I use OIDC with GitHub Actions?
OIDC lets a workflow request a GitHub-issued JSON Web Token (JWT) and present it to a cloud provider in exchange for a short-lived access token. That removes the need to store long-lived cloud credentials in GitHub secrets, but it does not remove the need to secure cloud access. The provider must validate the token and apply trust conditions before issuing credentials. GitHub’s guidance covers configuring OIDC in cloud providers and the OIDC token claims and reference.
Grant token-request permission only where needed
The job requesting the JWT needs id-token: write. This permission allows the workflow to request and use an OIDC token; it does not grant permission to write cloud resources. The cloud provider decides whether the token’s claims satisfy its trust policy and what role or access token to issue. Keep this permission scoped to the workflow or job that performs the cloud authentication, rather than granting it to unrelated jobs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Constrain the cloud trust policy
Configure the provider to trust only the intended GitHub identity and workflow context. At minimum, the trust configuration needs a condition so that an untrusted repository cannot obtain a token. Check the issuer, audience, subject or other relevant claims against the provider’s policy, then assign the resulting cloud role only the resource permissions the deployment requires. OIDC is not secure merely because the GitHub secret has been removed: broad claim conditions or an overpowered cloud role can still create excessive access.
Protect the deployment boundary
When a deployment uses a GitHub environment, configure its protection rules to restrict eligible branches or tags and, where appropriate, require controlled access to environment secrets. The environment boundary and the cloud trust policy should agree about which workflow is allowed to deploy. GitHub discusses environment protection as part of its OIDC deployment guidance.
Check the subject claim before changing cloud trust
Do not assume a repository’s OIDC sub value always has the same format. GitHub documents that repositories created after July 15, 2026, or repositories that opted in, include owner and repository IDs in the subject claim. Repository renames and transfers after that date also move to the immutable format. A provider trust policy must match the subject actually emitted for that repository; an old string may stop matching, while a condition that is broadened to work around a mismatch can admit identities you did not intend to trust.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before editing the provider policy, check the current claim format for the repository and consult GitHub’s OIDC reference. This is date-sensitive behavior, so verify the current documentation when configuring or troubleshooting trust.
How the three controls fit together
| Control | What it limits | What it does not guarantee |
|---|---|---|
| Full-length action SHA | Which revision of action code the workflow runs | That the selected code is safe or will remain appropriate to use |
Least-privilege GITHUB_TOKEN |
What repository operations the job’s token can perform | That an action cannot access the token or misuse other accessible data |
| OIDC with cloud-side trust conditions | Which GitHub-issued identities can exchange a JWT for cloud access, and which role is issued | That the cloud role is narrowly permissioned or that the workflow itself is trustworthy |
Apply all three at the same time: a pinned action can still abuse a broad token, a read-only GitHub token does not constrain cloud permissions, and OIDC does not make a mutable action reference safe. For repository-level controls on which actions are permitted, see GitHub’s documentation for managing GitHub Actions settings for a repository.
Review checklist
- Every action is pinned to a verified full-length commit SHA, and updates are reviewed.
- Action source and access to repository content, secrets, and tokens have been considered.
GITHUB_TOKENstarts with only the required permissions, with additional scopes granted only to jobs that need them.- Untrusted pull-request content and unreviewed actions are not given access to sensitive secrets or unnecessary write permissions.
- Only the job that authenticates to the cloud has
id-token: write. - The cloud provider’s issuer, audience, subject or claim conditions, and role permissions match the intended repository and deployment boundary.
- Any GitHub environment used for deployment has suitable protection rules, and its allowed branches or tags align with the cloud trust policy.
- The subject claim format has been checked against GitHub’s current OIDC reference, especially for repositories affected by the immutable-claims change.
For context on the token itself, GitHub also documents GITHUB_TOKEN as an Actions security concept.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
