DevSecOps › Module 3 › Lesson 1
GitHub Actions Hygiene
GitHub Actions hygiene literacy names workflow structure, least-privilege defaults, fork PR safety, and secret handling — read workflow YAML on YOUR $DEVSEC_LAB repos before enabling CI.
Visual · t36_github_actions_hygiene
GitHub Actions hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
One sloppy workflow YAML becomes a supply-chain hole — literacy teaches Actions hygiene so CI runs safely on repos you govern.
GitHub Actions hygiene covers workflow file structure — triggers, jobs, steps — least-privilege permissions blocks, avoiding pull_request_target abuse on forks, masking secrets in logs, and restricting who can approve workflow runs. A pinned third-party action beats a floating @main reference on YOUR lab repo. Cyberlium outlines Actions hygiene on YOUR $DEVSEC_LAB — sketch workflow skeleton with permissions and secret usage notes. Next: Permissions Pinning.
1. Actions hygiene components (named)
Structure: on triggers, job isolation, reusable workflows on YOUR repo. Permissions: default read-only, elevated only where needed. Fork safety: avoid dangerous pull_request_target patterns on public repos. Secrets: GitHub encrypted secrets, never echo in logs, rotate on leak.
On $DEVSEC_LAB, write hygiene row — workflow file, permission block, secret name for one fictional CI job.
Command guide
Try these commands — Actions hygiene components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ GitHub secret scanning — https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning NIST SSDF PS.1 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://gitleaks.io/ | head -10
cat > "$DEVSEC_LAB/notes/gitleaks-named.txt" <<'EOF'
Gitleaks — NAMED LITERACY:
Purpose: detect hardcoded secrets in git history and working tree
Command: gitleaks detect --source PATH --verbose
Config: .gitleaks.toml allowlist for FAKE lab strings if needed
CI: run on every PR — block merge on verified secret leak
FAKE lab rule: .env.example values MUST be labeled FAKE — never real keys
Lab: scan YOUR $DEVSEC_REPO only — never stranger org repos
EOFCommand — copy this
grep -E 'gitleaks detect|FAKE|stranger' "$DEVSEC_LAB/notes/gitleaks-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Gitleaks (https://gitleaks.io/); GitHub secret scanning (https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning); NIST SSDF PS.1 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Actions hygiene prevents pipeline compromise
Over-privileged GITHUB_TOKEN exfiltrates repo contents. Unpinned actions pull compromised upstream commits. Fork PR workflows can steal secrets if misconfigured — lab repos practice safe patterns first.
Students sketch lab workflows on notes — production Actions follow org security baselines and OIDC federation.
3. Lab boundary
Forbidden: copying stranger org workflow secrets into lab notes. Allowed: Actions hygiene card — skeleton with $DEVSEC_LAB fictional repo example.
Ship: GitHub Actions hygiene card for YOUR lab repo. Next: Permissions Pinning.
4. What you ship: GitHub Actions hygiene card for $DEVSEC_LAB
Workflow skeleton, permissions block, secret usage note. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Actions hygiene card. $DEVSEC_LAB named. File t36-m03-l01-github-actions-hygiene.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use GITHUB_TOKEN write-all on every job. Paste production PAT into lab workflow.
Right
Write GitHub Actions hygiene card for YOUR $DEVSEC_LAB. Next: Permissions Pinning.
Mission: sketch Actions hygiene on YOUR lab repo
1) List trigger, jobs, permissions sections. 2) Write least-privilege permissions block. 3) Name one secret usage rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Default read-only permissions — elevate per job, not globally.
Knowledge Check
APPLY: GitHub Actions hygiene primarily includes:
Multiple choice
Knowledge Check
APPLY: True or False: Default workflow permissions should be read-only unless a job needs more.
True or False
Knowledge Check
APPLY: Actions hygiene literacy on Cyberlium uses:
Multiple choice