Auditing GitHub Workflows for Security Risks: A Comprehensive Checklist

To combat the growing threat of supply-chain attacks targeting CI/CD pipelines, a recent article from OpenReplay Blog offers a detailed checklist for auditing GitHub Actions workflows for security vulnerabilities. The guide begins by advising a thorough check of `GITHUB_TOKEN` permissions. Workflows often inherit default permissions that are overly broad, especially in older organizations. Explicitly setting a `permissions: {}` block at the workflow level forces granular control, ensuring jobs only possess the necessary access. Another critical area is the examination of shell commands for untrusted input. Improper handling of variables, particularly those from pull requests, can lead to script injection vulnerabilities. The article suggests careful validation and sanitization of all external inputs. Auditing `pull_request_target` usage is also highlighted as a high-risk area. While GitHub has introduced some mitigations, combining this trigger with fork checkouts can still expose repositories to malicious code execution. The recommendation is to avoid executing code from the PR branch when `pull_request_target` is in use. The article stresses the importance of reviewing third-party action pinning. Unpinned actions can be silently updated with malicious code. Enforcing SHA pinning through organization-level policies and implementing a cooldown period for new action versions can significantly reduce this risk. Self-hosted runner exposure is another concern. These runners are persistent, making them susceptible to backdoors if compromised. The guide recommends ensuring public repositories do not use sensitive self-hosted runners and preferring just-in-time (JIT) runners that are destroyed after each job for sensitive workloads. Finally, the article advocates for replacing long-lived cloud credentials with OIDC (OpenID Connect) tokens. OIDC provides short-lived, scoped credentials, drastically limiting the blast radius in case of a compromise and reducing the burden of credential rotation.