GitHub Actions Hygiene

GitHub Actions hygiene literacy names workflow structure, least-privilege defaults, fork PR safety, and secret handling — read workflow YAML on YOUR $DEVSEC_LAB repos before enabling CI.

GitHub Actions Hygiene• Audio Walkthrough

00:00/03:26

Visual · t36_github_actions_hygiene

GitHub Actions hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.

One sloppy workflow YAML becomes a supply-chain hole — literacy teaches Actions hygiene so CI runs safely on repos you govern.

GitHub Actions hygiene covers workflow file structure — triggers, jobs, steps — least-privilege permissions blocks, avoiding pull_request_target abuse on forks, masking secrets in logs, and restricting who can approve workflow runs. A pinned third-party action beats a floating @main reference on YOUR lab repo. Cyberlium outlines Actions hygiene on YOUR $DEVSEC_LAB — sketch workflow skeleton with permissions and secret usage notes. Next: Permissions Pinning.

1. Actions hygiene components (named)

Structure: on triggers, job isolation, reusable workflows on YOUR repo. Permissions: default read-only, elevated only where needed. Fork safety: avoid dangerous pull_request_target patterns on public repos. Secrets: GitHub encrypted secrets, never echo in logs, rotate on leak.

On $DEVSEC_LAB, write hygiene row — workflow file, permission block, secret name for one fictional CI job.

Command guide

Try these commands — Actions hygiene components (named)

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: curl, grep. Reference sites: Gitleaks (https://gitleaks.io/); GitHub secret scanning (https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning); NIST SSDF PS.1 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why Actions hygiene prevents pipeline compromise

Over-privileged GITHUB_TOKEN exfiltrates repo contents. Unpinned actions pull compromised upstream commits. Fork PR workflows can steal secrets if misconfigured — lab repos practice safe patterns first.

Students sketch lab workflows on notes — production Actions follow org security baselines and OIDC federation.

3. Lab boundary

Forbidden: copying stranger org workflow secrets into lab notes. Allowed: Actions hygiene card — skeleton with $DEVSEC_LAB fictional repo example.

Ship: GitHub Actions hygiene card for YOUR lab repo. Next: Permissions Pinning.

4. What you ship: GitHub Actions hygiene card for $DEVSEC_LAB

Workflow skeleton, permissions block, secret usage note. $DEVSEC_LAB named. chmod 600.

5. What you record before the next lesson

Date. Actions hygiene card. $DEVSEC_LAB named. File t36-m03-l01-github-actions-hygiene.txt chmod 600.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Use GITHUB_TOKEN write-all on every job. Paste production PAT into lab workflow.
Right: Write GitHub Actions hygiene card for YOUR $DEVSEC_LAB. Next: Permissions Pinning.

Hands-on Exercise