GitHub Actions 1 cheatsheet
GitHub Actions 1: Secrets and security
4 common GitHub Actions 1 tasks.
Use a secret
Read a repository secret. Secrets are masked in logs.
env:
API_KEY: ${{ secrets.API_KEY }}
Limit the token's permissions
Give GITHUB_TOKEN only the access the workflow needs.
permissions:
contents: read
pull-requests: write
Require approval for a deployment
Target an environment that has protection rules, such as required reviewers.
jobs:
deploy:
environment: production
Pin an action to a commit
Use a full commit SHA instead of a tag so a retagged action can't change under you.
- uses: actions/checkout@<full-length-commit-sha>