Lock Your GitHub Actions: A GitHub Actions Security Primer

Your login page, your customer records, your payment keys — they often sit in the same place the build runs. A hijacked action can read all of it and print it into a log that anyone on the team can open.

It has already happened at scale. In early 2025, a widely used action was compromised and leaked credentials into build logs, catching thousands of projects. Nobody did anything unusual. They just trusted a version tag.

So even if you never touch code, you can ask one useful question: are our build tools pinned to exact versions, or floating?

How to lock yours in an afternoon

• Pin to the full 40-character commit hash. That's a fingerprint for one exact snapshot of the code. A hash can't be moved; a tag like v4 can.
• Set the default token to read-only. In your repo, go to Settings → Actions → General → Workflow permissions.
• Never pair pull_request_target with code from a fork. That combination hands strangers your secrets.
• Scope every secret to the one job that needs it, and keep secrets out of logs.
• Use short-lived cloud tokens (OIDC) instead of long-lived keys where your provider supports it.
• Require approval for workflows from first-time contributors.

What locking won't save you from

Pinning is a seatbelt, not a force field. If the action you pin is already malicious, you've just frozen the problem in place. Read what you install, prefer actions from GitHub or the cloud provider you already pay, and keep the list short.

Pinned versions also go stale. Turn on Dependabot or Renovate so it bumps the hashes for you and opens a pull request you can review. The real fix sits higher up: organisation-level rules that only allow approved actions. Watch for more of those controls, because individual discipline doesn't scale.

Key Takeaways

• A version tag can be repointed at new code; a commit hash cannot.
• Default write permissions turn a small bug into a full data leak.
• One compromised helper script can expose every secret in your build.
• Automatic dependency updates solve the "pinned but outdated" problem.

Frequently Asked Questions