GitHub Actions: Secrets, Permissions, Security, and OIDC

GitHub Actions•Permalink

Secure GitHub Actions workflows with permissions, environments, secrets, masking, fork safety, and OpenID Connect for cloud auth.

View

Standard Detailed Compact

Export

Copy the compact sheet, download it, or print it.

Download

`D` dense toggle · `C` copy all

## Permissions and secrets

Set least-privilege token permissions

↗#

permissions:
  contents: read

# Limit the default GITHUB_TOKEN scope.

Grant write access only where needed

↗#

jobs:
  release:
    permissions:
      contents: write

# Elevate token permissions on a specific job.

Expose a secret as an environment variable

↗#

- name: Login
  env:
    API_TOKEN: ${{ secrets.API_TOKEN }}
  run: ./scripts/login.sh

# Use the `secrets` context in step env.

Mask a dynamic sensitive value

↗#

echo "::add-mask::$TOKEN"

# Hide a generated or fetched secret from logs.

Use protected environments for deploys

↗#

jobs:
  deploy:
    environment: production

# Require approval and environment-scoped secrets.

## OIDC and fork safety

Enable OIDC token issuance

↗#

permissions:
  id-token: write
  contents: read

# Grant `id-token: write` when using cloud federation.

Configure AWS credentials via OIDC

↗#

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
    aws-region: us-east-1

# Use the AWS credentials action without long-lived keys.

Authenticate to Google Cloud with OIDC

↗#

- uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/pool/providers/provider
    service_account: deployer@example-project.iam.gserviceaccount.com

# Use workload identity federation for GCP.

Do not expose secrets to untrusted forks

↗#