Protect source and CI
Minimize CI authority
Give workflows narrow token permissions, protect untrusted pull requests, pin external actions, and separate testing from publishing.
8 minute lesson
CI runs code and often holds credentials. A pull request may therefore be an attempt to execute code inside your trusted environment.
Set explicit minimal token permissions, do not expose secrets to untrusted forks, and keep release jobs behind protected events and environments. Pin external actions to reviewed immutable references and update them deliberately.
permissions:
contents: readA workflow triggered with pull_request_target checks out code from an external contributor. That code now runs in the trusted base-repository context and may reach secrets or a write-capable token.
Tests and releases need different authority. Combining them makes every test execution a possible publishing event.
Map the trigger, token permissions, secrets, third-party actions, and environments for one workflow. Save a run showing that untrusted pull-request code receives no publishing credential. Then attempt a write operation from that job and capture the expected permission failure.
Lesson completed