Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

docs: security hardening info for actions untrusted content#38048

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
wrslatz wants to merge15 commits intogithub:main
base:main
Choose a base branch
Loading
fromwrslatz:gha-hardening-pull-request-target

Conversation

wrslatz
Copy link
Contributor

@wrslatzwrslatz commentedMay 5, 2025•
edited
Loading

Why:

TheSecurity hardening for GitHub Actions documentation currently has no content or recommendations covering untrusted contents being checked out and executed in Actions workflow runs. Someone recently shared theGrafana GitHub Actions Security Incident write up from StepSecurity and I went to share the hardening guide with them only to not find any recommendations covering this case. I did sharehttps://securitylab.github.com/research/github-actions-preventing-pwn-requests/ with them, but this was harder to find since it is not in the GitHub docs. I expected this security issue to be covered in the docs since untrusted input and third-party Actions, which have similar implications, are covered in the same docs already.

What's being changed (if available, include any code snippets, screenshots, or gifs):

Document the risks and recommended hardening mitigations for untrusted content being checked out and executed in GitHub Actions pull requests.

Check off the following:

  • A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
  • The changes in this PR meetthe docs fundamentals that are required for all content.
  • All CI checks are passing and the changes look good in the review environment.

@github-actionsgithub-actionsbot added the triageDo not begin working on this issue until triaged by the team labelMay 5, 2025
@github-actionsGitHub Actions
Copy link
Contributor

github-actionsbot commentedMay 5, 2025•
edited
Loading

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in thecontent directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to thedata directory are not included in this table.

SourceReviewProductionWhat Changed
actions/how-tos/security-for-github-actions/security-guides/security-hardening-for-github-actions.mdfpt
ghec
ghes@3.173.163.153.143.13
fpt
ghec
ghes@3.173.163.153.143.13
actions/reference/events-that-trigger-workflows.mdfpt
ghec
ghes@3.173.163.153.143.13
fpt
ghec
ghes@3.173.163.153.143.13
enterprise-onboarding/github-actions-for-your-enterprise/security-hardening-for-github-actions.mdghec
ghec

Key:fpt: Free, Pro, Team;ghec: GitHub Enterprise Cloud;ghes: GitHub Enterprise Server

🤖 This comment isautomatically generated.

@Sharra-writesSharra-writes added contentThis issue or pull request belongs to the Docs Content team github_actionsPull requests that update GitHub Actions code and removed triageDo not begin working on this issue until triaged by the team labelsMay 5, 2025
@Sharra-writesSharra-writes added the needs SMEThis proposal needs review from a subject matter expert labelMay 28, 2025
@github-actionsGitHub Actions
Copy link
Contributor

Thanks for opening a pull request! We've triaged this issue for technical review by a subject matter expert 👀

wrslatz reacted with heart emoji

@github-actionsGitHub Actions
Copy link
Contributor

This is a gentle bump for the docs team that this PR is waiting for technical review.

wrslatz reacted with heart emoji

@github-actionsgithub-actionsbot added the SME staleThe request for an SME has staled labelJun 25, 2025
@Sharra-writesSharra-writes removed the SME staleThe request for an SME has staled labelJun 25, 2025
@wrslatzwrslatzforce-pushed thegha-hardening-pull-request-target branch from565bb47 to0ef89bbCompareJune 29, 2025 02:02
@wrslatzwrslatzforce-pushed thegha-hardening-pull-request-target branch from4ba4fac to2b34cc3CompareJuly 9, 2025 15:47
@Sharra-writesSharra-writes added SME reviewedAn SME has reviewed this issue/PR waiting for reviewIssue/PR is waiting for a writer's review and removed needs SMEThis proposal needs review from a subject matter expert labelsJul 9, 2025
@Sharra-writes
Copy link
Contributor

@wrslatz Sorry this took a while! I think I talked to most of the Actions teams before I found the one I needed to get the SME review. I'm referring it to our writers to review for style now. Thank you for being patient.

wrslatz reacted with heart emoji

@wrslatz
Copy link
ContributorAuthor

@wrslatz Sorry this took a while! I think I talked to most of the Actions teams before I found the one I needed to get the SME review. I'm referring it to our writers to review for style now. Thank you for being patient.

Thanks,@Sharra-writes !

wrslatzand others added9 commitsJuly 10, 2025 09:38
…uides/security-hardening-for-github-actions.mdCo-authored-by: Jaroslav Lobačevski <jarlob@github.com>Co-authored-by: Will Slattum <wrslatz@gmail.com>
…uides/security-hardening-for-github-actions.mdCo-authored-by: Jaroslav Lobačevski <jarlob@github.com>Co-authored-by: Will Slattum <wrslatz@gmail.com>
…uides/security-hardening-for-github-actions.mdCo-authored-by: Jaroslav Lobačevski <jarlob@github.com>Co-authored-by: Will Slattum <wrslatz@gmail.com>
Co-authored-by: Jaroslav Lobačevski <jarlob@github.com>Co-authored-by: Will Slattum <wrslatz@gmail.com>
Co-authored-by: Jaroslav Lobačevski <jarlob@github.com>Co-authored-by: Will Slattum <wrslatz@gmail.com>
@wrslatz
Copy link
ContributorAuthor

I found an additional section of the docs that need an update related to this change. Pushing that up shortly.

Sharra-writes reacted with thumbs up emoji

@wrslatzwrslatz marked this pull request as draftJuly 10, 2025 14:04
@wrslatzwrslatzforce-pushed thegha-hardening-pull-request-target branch from5b22da2 tof471511CompareJuly 10, 2025 18:49
@wrslatz
Copy link
ContributorAuthor

@Sharra-writes@JarLob I found additional content in enterprise guidance that I updated inf471511. Let me know what you think.

@dhianne92

This comment was marked as spam.

@wrslatzwrslatz marked this pull request as ready for reviewJuly 10, 2025 21:44
@Sharra-writes
Copy link
Contributor

@wrslatz We're doing some work on the organization of Actions articles, so the team asked me to put this on hold on our review board until that's finished, but hopefully that will give you time to get another review from the security folks, since the writing review needs to be the final thing once we know the information is correct.

wrslatz reacted with thumbs up emoji

Co-authored-by: Jaroslav Lobačevski <jarlob@github.com>
@wrslatzwrslatz requested a review fromJarLobJuly 14, 2025 18:57
@wrslatz
Copy link
ContributorAuthor

wrslatz commentedJul 14, 2025•
edited
Loading

@Sharra-writes Got security review 🎉 I can always rebase once those changes are in, just keep me posted.

Sharra-writes reacted with thumbs up emoji

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@JarLobJarLobJarLob approved these changes

@Sharra-writesSharra-writesAwaiting requested review from Sharra-writes

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
contentThis issue or pull request belongs to the Docs Content teamgithub_actionsPull requests that update GitHub Actions codeSME reviewedAn SME has reviewed this issue/PRwaiting for reviewIssue/PR is waiting for a writer's review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

4 participants
@wrslatz@Sharra-writes@dhianne92@JarLob
[8]ページ先頭
©2009-2025 Movatter.jp