SHARED PASSWORD REPOSITORY CODE

This cheat sheet is here to help you mind the risks posed by some GitHub Action workflows, no matter if you are maintaining open-source projects or not.

SHARED PASSWORD REPOSITORY CODE

Sounds scary? Maybe, but far from impossible! This is why it is recommended that developers always check the code before downloading new third-party apps and set up billing alerts if necessary to avoid unexpected costs. Nightmare scenario: imagine a malicious GitHub Action stealing secrets passed to the CI is published in the GitHub Marketplace to mine cryptocurrencies. A step can be a shell script or an action, which is a reusable piece of code specially packaged for the GitHub CI ecosystem.īecause GitHub is hosting millions of open-source projects that can be forked and contributed to through pull requests, GitHub Actions security is paramount to prevent supply-chain attacks. For instance, they can be used to format the code, format the PR, sync an issue's comments with another ticketing system’s comments, add the appropriate labels to a new issue, or trigger a full-scale cloud deployment.Ī workflow is made of one or more jobs, which are run inside their own virtual machine or container (a runner), that execute one or more steps. Actions are triggered by GitHub events (a pull request is submitted, an issue is opened, a PR is merged, etc…) and can execute pretty much any command. It’s the mechanism used to run workflows from development to production systems.

GitHub Actions is GitHub’s CI/Cd service.

Shared password repository