Which best practices improve the security of GitHub Actions workflows?

• A. Use broad permissions everywhere to simplify access.
• B. Limit permissions, avoid secrets in logs, use secret scanning, pin actions, enable workflow run permissions.
• C. Ignore secret scanning; rely on manual checks.
• D. Disable pins on actions to allow frequent updates.

Answer: (B)

Limiting what your workflows can do and how they handle secrets is the key to safer GitHub Actions. By granting only the minimum permissions needed for a workflow to run, you minimize the potential damage if a workflow or an action is compromised. This means configuring the token and job-level permissions so you’re not giving broad admin access across the repository, but rather just what’s necessary for tasks like reading code, creating issues, or making deployments.

Avoid exposing secrets in your logs. Secrets should be passed to actions through the secrets store and not echoed or printed in command outputs. Even though GitHub redacts secrets, it’s still essential to design steps so you never reveal sensitive values, and to keep secret handling isolated to secure inputs rather than broad environment dumps.

Secret scanning adds a proactive layer of defense. Enabling secret scanning helps catch accidentally committed credentials before they can be abused, and it complements your awareness and rotation processes for keys and tokens.

Pinning actions is a practical security habit. By using specific versions or commit SHAs rather than floating tags, you lock in a known, reviewed code path for your workflows and reduce the risk of supply chain issues or malicious changes appearing in your CI/CD.

Enable workflow run permissions to control access to secrets and privileged actions during a run. Tightening these permissions ensures that a workflow run cannot access more sensitive resources than it should and that the GITHUB_TOKEN behaves in a restricted, predictable way.

Together, these practices create a safer environment for automated builds and deployments, shielding your code, secrets, and infrastructure from common CI/CD risks.