If a stolen maintainer token or an over-privileged bot account can merge and deploy alone, the pipeline's own speed delivers the attacker's change. Every route around review, such as an exempted account, an auto-merge rule or a manual artifact upload, counts.
- Protect production branches and release tags with required review, and avoid exempting accounts or branches from the rules.
- Keep auto-merge rules few and narrow, and review their code so they cannot be bypassed.
- Require approval before a production deployment runs, for example a protected environment with required reviewers.
- Let only artifacts built by the approved CI identity flow onward, and detect drift between what runs in production and its pipeline origin.
Guides on this site
Protect the source repository: rulesets, reviews and signed commits
Configure the controls every repository that ships software needs: protected branches and tags, required review with CODEOWNERS, signed commits, secret push protection and account security, mapped to the SLSA Source track, the OpenSSF OSPS Baseline and Scorecard.
Protect the path from pull request to release
Separate untrusted contribution checks from privileged release work and verify the identity of the artifact that is actually deployed.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Meet the OpenSSF OSPS Baseline as a maintainer: the levels, every Level 1 control on GitHub, and the evidence
Walk through the eight control families and three maturity levels of OSPS Baseline v2026.08.28, meet each Level 1 requirement on a GitHub repository, and keep evidence a consumer can check.
Practice
- Actions injection lab: Flag GitHub Actions expression injection · Browser lab
- Build and verify a signed software release · Local project
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.