World map

 

BM

World 7: Robots: Actions & CI/CD

Keep workflows safe

You will learn: how to give your robot only the power it needs.

The problem

Your workflow can read secrets and change your repo. Any code it runs gets those powers too. Who could misuse them?

Watch

Tap each point on the timeline.

Each job gets a fresh key: the GITHUB_TOKEN: A short-lived key each job gets. It stops working when the job ends.. It only works in this repo. It stops working when the job ends.

Watch

permissions: The list of what GITHUB_TOKEN may do, like read code or write to Pages. says what that key may do. Give only what the job needs. List some, and the rest become none. Which one does each job need?

Drag a card into a box. Or tap the card, then tap the box.

        Predict

        A job has only contents: read. A bad step tries to push code. What happens?

        Try it

        Spot the risks. Tap every risky line.

        Tap every risky line.

        0 of 3 found

        Watch

        pull_request_target runs with your secrets and a write key. Even on a stranger’s PR! So never run their code there. Which trigger should test a stranger’s PR code?

        Check

        Safe habit, or risky? Swipe each one.

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        Start every workflow with contents: read

        You did it!

        You can now lock down a workflow.

        Go deeper (optional)

        Text from strangers, like a PR title, can sneak commands into run:. Put it in env: first, then use "$TITLE" in the script. persist-credentials: false on checkout keeps the key out of the repo’s Git config. This course’s own workflow does that.