Keep secrets out of builds from strangers

How to do it

Run pull requests from forks without secrets. Never check out or run a fork's code in a job that has secrets, such as a GitHub pull_request_target job. Keep deploy keys in protected environments that only the main branch can use. Prefer short-lived cloud tokens through OIDC over stored keys. Pin build actions to a full commit hash, as Lock every CI action and its dependencies to a reviewed commit says. Give the build token read-only access unless a job needs more.

Examples

YAML example

permissions:
  contents: read
jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    environment: production

How to check

Open a test pull request from a fork that prints the environment. No secret appears in the log. A search of the workflows finds no pull_request_target job that checks out the pull request's code, and every action is pinned to a 40-character hash.

Sources

• GitHub Actions secure use reference

Related rules

• AID-22 Have someone other than the requester approve agent changes in AI-assisted development
• AID-29 Run agents in CI only for trusted people in AI-assisted development
• ENG-16 Run the checks on every change in Engineering
• ENG-41 Keep untrusted text out of CI scripts in Engineering
• ENG-56 Run outside code only on runners that are wiped after each job in Engineering
• MOB-8 Sign release builds only in CI in Mobile apps
• OSS-10 Review build files and test data in every outside change in Open source maintenance
• OSS-30 Run the OpenSSF Scorecard every week in Open source maintenance
• ENG-55 Lock every CI action and its dependencies to a reviewed commit in Engineering