Guidance on command injection and workflow execution security in GitHub Actions.
| Article | Path |
|---|---|
| GitHub Actions run block command injection | cicd/github/run_block_injection |
| GitHub Actions script block injection | cicd/github/script_block_injection |
| GitHub Actions not pinned to a full commit SHA | cicd/github/unpinned_actions_full_length_commit_sha |
| GitHub Actions permits insecure commands | cicd/github/unsecured_commands |
Pass untrusted GitHub Actions event values as data instead of inserting them directly into shell code.
Pass external values to actions/github-script as JavaScript data instead of embedding them in code.
Pin external actions to a verified full commit SHA to reduce unexpected changes to the referenced code.
Remove the GitHub Actions setting that permits insecure commands and use environment files.
