Least privilege, OIDC, protected variables, pinning, and release governance for safer pipelines.
Secure what your pipelines can access and modify.
Explicitly scope the token for each workflow or job.
permissions:
contents: readSet the default permission level deliberately and elevate only when a job truly needs more access.
Exchange a short-lived identity token for cloud credentials.
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
aws-region: us-east-1OIDC reduces secret sprawl by replacing stored cloud keys with short-lived federated credentials.
deploy_production:
stage: deploy
only:
- mainPair protected branches/tags with protected variables so untrusted branches cannot access deploy secrets.
Pin dependencies, isolate trust, and gate releases.
- uses: actions/checkout@v4Pinning reduces surprise breakage. For higher assurance, pin to a full commit SHA after validation.
on:
pull_request:
branches: [main]Treat external contributions as untrusted. Split validation workflows from secret-bearing deploy workflows.
Protect the production environment.
Require reviewers for prod deploy jobs.
Separate CI from production credentials.Human approval is still one of the most effective controls for high-impact environments.