rules-github-actions

Injecting github.event context directly into run: steps allows attackers to execute arbitrary code via crafted PR titles, commit messages, or issue bodies. Store the value in an env variable first and reference $ENV_VAR in the run step.

RISK: Cache keys derived from PR-controlled data (branch name, event payload) allow cache poisoning — a malicious PR can write a poisoned cache entry that a later trusted workflow restores and executes (pwn-request cache poisoning pattern). FIX: Scope cache keys to trusted data only: runner.os, hashFiles(), and static strings.

RISK: Granting id-token: write without a branch/environment condition allows any workflow trigger (including PRs from forks) to obtain a cloud OIDC token, enabling unauthorized cloud resource access. FIX: Restrict jobs that need OIDC tokens to protected environments or specific branch conditions (github.ref == 'refs/heads/main').

RISK: Embedding untrusted user-controlled data (branch names, event payloads) in workflow run-name can inject JavaScript into the Actions UI if GitHub ever changes how run names are rendered — defense-in-depth. FIX: Use only static strings or trusted context values (github.actor, github.sha) in run-name.

RISK: workflow_dispatch string inputs are stored in the audit log and visible in the Actions UI run history — passing secrets as inputs exposes them to anyone with Actions read access. FIX: Use GitHub Actions secrets (${{ secrets.MY_SECRET }}) rather than input parameters for sensitive values; use type: choice to constrain valid non-sensitive inputs.

Hardcoded secrets in workflow files are stored in plaintext in the repository. Use encrypted GitHub Secrets: ${{ secrets.MY_SECRET }} or environment secrets.

pull_request_target with actions/checkout of the PR branch executes untrusted code with write permissions — the most critical GitHub Actions misconfiguration. Use pull_request instead, or explicitly checkout the base branch.

Self-hosted runners on pull_request events in public repos allow untrusted fork PRs to execute code on your infrastructure. Use GitHub-hosted runners for public repo CI, or require approval for fork PRs.

Referencing actions by branch name or floating tag allows supply chain attacks — the action can be updated to malicious code. Pin to a full commit SHA: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

write-all permissions grant the workflow GITHUB_TOKEN access to write to all repository resources. Apply least-privilege: declare only the specific permissions needed (e.g., contents: read).