How do you prevent secret exposure and follow security hardening best practices in GitHub Actions?

GitHub Actions workflows run code triggered by events — including potentially untrusted content from pull requests — so hardening them against secret exposure and code injection is essential.

1. Pin third-party actions to a full commit SHA. A mutable version tag like @v3 can be silently updated to inject malicious code. A SHA cannot be changed:

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

2. Use minimum required permissions. Declare permissions: {} at the workflow level to deny everything, then grant only what specific jobs need:

permissions: {}
jobs:
  release:
    permissions:
      contents: write
      packages: write

3. Never interpolate untrusted input directly into run: scripts. Pull request titles, branch names, and issue bodies are attacker-controlled. This is vulnerable to shell injection:

# DANGEROUS — do not do this
- run: echo "PR title: ${{ github.event.pull_request.title }}"

Safe approach — pass through an environment variable:

- run: echo "PR title: $PR_TITLE"
  env:
    PR_TITLE: ${{ github.event.pull_request.title }}

4. Avoid pull_request_target unless you understand its risks. It runs in the base branch context with access to secrets, so executing checkout + build of the fork code is dangerous.

5. Use GitHub's security features alongside Actions:

• Enable secret scanning to detect accidentally committed credentials
• Use github/codeql-action for SAST in the CI pipeline
• Enable Dependabot to auto-update action versions
• Use environment protection rules (required reviewers) for production deployments