DevSecOps › Module 3 › Lesson 1
GitHub Actions Hygiene
GitHub Actions hygiene literacy names workflow structure, least-privilege defaults, fork PR safety, and secret handling — read workflow YAML on YOUR $DEVSEC_LAB repos before enabling CI.
Visual · t36_github_actions_hygiene
GitHub Actions hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
One sloppy workflow YAML becomes a supply-chain hole — literacy teaches Actions hygiene so CI runs safely on repos you govern.
GitHub Actions hygiene covers workflow file structure — triggers, jobs, steps — least-privilege permissions blocks, avoiding pull_request_target abuse on forks, masking secrets in logs, and restricting who can approve workflow runs. A pinned third-party action beats a floating @main reference on YOUR lab repo. Cyberlium outlines Actions hygiene on YOUR $DEVSEC_LAB — sketch workflow skeleton with permissions and secret usage notes. Next: Permissions Pinning.
1. Actions hygiene components (named)
Structure: on triggers, job isolation, reusable workflows on YOUR repo. Permissions: default read-only, elevated only where needed. Fork safety: avoid dangerous pull_request_target patterns on public repos. Secrets: GitHub encrypted secrets, never echo in logs, rotate on leak.
On $DEVSEC_LAB, write hygiene row — workflow file, permission block, secret name for one fictional CI job.
Command guide
Try these commands — Actions hygiene components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: curl, grep. Reference sites: Gitleaks (https://gitleaks.io/); GitHub secret scanning (https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning); NIST SSDF PS.1 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Actions hygiene prevents pipeline compromise
Over-privileged GITHUB_TOKEN exfiltrates repo contents. Unpinned actions pull compromised upstream commits. Fork PR workflows can steal secrets if misconfigured — lab repos practice safe patterns first.
Students sketch lab workflows on notes — production Actions follow org security baselines and OIDC federation.
3. Lab boundary
Forbidden: copying stranger org workflow secrets into lab notes. Allowed: Actions hygiene card — skeleton with $DEVSEC_LAB fictional repo example.
Ship: GitHub Actions hygiene card for YOUR lab repo. Next: Permissions Pinning.
4. What you ship: GitHub Actions hygiene card for $DEVSEC_LAB
Workflow skeleton, permissions block, secret usage note. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Actions hygiene card. $DEVSEC_LAB named. File t36-m03-l01-github-actions-hygiene.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use GITHUB_TOKEN write-all on every job. Paste production PAT into lab workflow.
Right
Write GitHub Actions hygiene card for YOUR $DEVSEC_LAB. Next: Permissions Pinning.
Mission: sketch Actions hygiene on YOUR lab repo
1) List trigger, jobs, permissions sections. 2) Write least-privilege permissions block. 3) Name one secret usage rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Default read-only permissions — elevate per job, not globally.
Knowledge Check
APPLY: GitHub Actions hygiene primarily includes:
Multiple choice
Knowledge Check
APPLY: True or False: Default workflow permissions should be read-only unless a job needs more.
True or False
Knowledge Check
APPLY: Actions hygiene literacy on Cyberlium uses:
Multiple choice