GitHub Actions: Pin Permissions and Inspect Secrets
A workflow may receive more repository access than a test job needs. This guide gives you a small, testable way to approach the issue before changing a live system.
A practical workflow
- Set minimum permissions for the workflow or job and use short-lived tokens where supported.
- Review third-party actions, triggers and pull-request context before exposing secrets.
What to check
A workflow from an untrusted contribution must not receive deployment credentials by default. Compare the result with the original problem and record what changed. If a measurement or test does not support the change, revisit the assumption rather than adding more complexity.
Keep the experiment small enough to reverse. Document the starting state, the change and the result so another person can repeat the process. Product menus and versions can change, so check the current documentation for your environment.
Official reference: Read the documentation.