GitHub Actions hardening guides
The six habits Anchorflow checks, each with the risk, the before and after, and how to verify it yourself.
- How to pin GitHub Actions to a commit SHAWhy a tag like @v4 can change under you, how to pin every action to a full commit SHA, and how to keep Dependabot updates working.
- GITHUB_TOKEN permissions: how to set least privilegeHow the permissions block works at workflow and job level, why unset permissions are risky, and a least-privilege pattern you can copy.
- Template injection in GitHub Actions, and the one-line fixHow ${{ github.event.* }} in run, with or if turns a pull request title into code, which fields are attacker-controlled, and how to fix it with env.
- pull_request_target and workflow_run: running untrusted code safelyWhy pull_request_target runs with a write token and secrets, how checking out the pull request's head turns that into code execution, and what to do instead.
- actions/checkout persist-credentials: why to turn it offactions/checkout leaves the job's token in .git/config by default. Here is when that matters and how to switch it off.
- How to verify a pinned GitHub Action SHA yourselfCheck that a pinned SHA really is the commit a tag points at, using git ls-remote or the GitHub API, without trusting any tool.