Securing your GitHub Actions

Now that you have learned how to create GitHub Actions workflows from scratch – and how to customize existing workflows templates – you have seen how the secrets context is often used within those workflows. Using secrets is the most important security practice you can adopt to keep your GitHub Actions features safe. However, there are other good practices that you should consider. This section will present the following best practices:

• Secrets – how to create and use them
• Securely adding third-party actions to your workflow
• Best practices for securing self-hosted runners

Let's look at these in more detail.

Secrets – how to create and use them

Secrets are encrypted environment variables that you can store at the repository, environment, or organization levels. Organization-level secrets are outside the scope of this book.

A brief overview

Except for the GITHUB_TOKEN secret – more...