Supply chain and setup Required

Keep secrets out of builds from strangers

Never give deploy keys or other secrets to builds that run code from outside contributors. Give each build job only the access it needs.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Run pull requests from forks without secrets. Never check out or run a fork's code in a job that has secrets, such as a GitHub pull_request_target job. Keep deploy keys in protected environments that only the main branch can use. Prefer short-lived cloud tokens through OIDC over stored keys. Pin build actions to a full commit hash. Give the build token read-only access unless a job needs more.

Example

permissions:
  contents: read
jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    environment: production

How to check

Open a test pull request from a fork that prints the environment. No secret appears in the log. A search of the workflows finds no pull_request_target job that checks out the pull request's code, and every action is pinned to a 40-character hash.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/ci-secrets.