Cheat SheetsCI/CD & GitHub ActionsSecurity

Security — Cheat Sheet

CI/CD & GitHub Actions · 1 topics. Download the PDF or the Instagram carousel and share it.

Cheat Sheet · AiCanCode.org
Security
CI/CD & GitHub Actions1 topicsQuick revision reference
1

Secrets, Environments & OIDC

GitHub Actions Secrets store sensitive values encrypted at rest. Environments add deployment protection rules with manual approval gates. OIDC enables keyless authentication to cloud providers.

  • ✓Three secret scopes: repository (all workflows), environment (only jobs using that env), organisation (shared across repos).
  • ✓Environment protection rules add required reviewers and branch restrictions before production deployments.
  • ✓GITHUB_TOKEN is auto-created per run — grant only necessary permissions (permissions: block).
  • ✓Pin third-party actions to commit SHAs to prevent supply chain attacks via moved tags.
  • ✓OIDC eliminates long-lived cloud credentials stored in secrets — use it for AWS, GCP, and Azure.
  • ✓Environments have their own secret store — staging and production can have different DB credentials.
GitHub secrets scopes and usage
# Three secret scopes:



# 1. Repository secrets: available to all workflows in the repo

# Settings → Secrets and variables → Actions → New repository secret

# Name: DB_PASSWORD, Value: mysecretpassword



# 2. Environment secrets: only available to jobs using that environment

# Settings → Environments → staging → Add secret

# Only jobs with 'environment: staging' can access these secrets

# Use for environment-specific credentials (staging DB vs prod DB)



# 3. Organization secrets: shared across repos in the org

# Org Settings → Secrets → Specify which repos can access



# Using secrets in a workflow:

jobs:

  deploy:

    runs-on: ubuntu-latest

    environment: production          # unlocks production environment secrets

    steps:

      - name: Deploy

        env:

          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}         # repo secret

          PROD_API_KEY: ${{ secrets.PROD_API_KEY }}       # env secret (production)

          ORG_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} # org secret

        run: ./deploy.sh



# Built-in secrets (no setup needed):

# secrets.GITHUB_TOKEN  → auto-created per workflow run, scoped to the repo

#   permissions: packages: write → push images

#   permissions: pull-requests: write → comment on PRs

#   permissions: contents: write → push tags, create releases



# Secret masking in logs:

run: echo "Password is ${{ secrets.DB_PASSWORD }}"

# Output: Password is ***   ← automatically masked
Learn this free with Aria, your AI tutor → AiCanCode.org/learn/cicd