Secure and optimize automation

Your organization builds a container image in CI and generates a build provenance attestation with the actions/attest-build-provenance action. Before a production deployment job pulls and runs the image, the security team requires the deployment runner to cryptographically confirm that the image was built by your organization's repository and not tampered with. Which command should the deployment job run to enforce this?

Your CI workflow builds and caches Node dependencies using a key derived from package-lock.json. The workflow triggers on both pull_request from forks and push to main. A security reviewer warns that a malicious contributor could poison the shared cache. What is the MOST accurate description of GitHub Actions cache scoping that mitigates this concern, and what remaining precaution is still required?

Your security team wants every new repository in the organization to start with a GITHUB_TOKEN that has read-only access to repository contents by default, so that individual workflows must explicitly opt into any write scopes they need. Which configuration achieves this least-privilege baseline across the org without editing each workflow file?

A team deploys to production using a job that references `environment: production`. Security requires that no deployment to production proceeds without explicit human sign-off from a designated release manager, and that the workflow pauses until that approval is granted. Which configuration on the production environment satisfies this requirement?

Your team ships a container image built in a GitHub Actions workflow, and your security team now requires cryptographically verifiable provenance (SLSA build metadata) tied to the build. You want to generate this attestation directly in the workflow using GitHub's native tooling, with the least additional infrastructure. Which combination of workflow configuration correctly produces a signed provenance attestation for the built artifact?

A developer on your team is debugging a workflow that calls the GitHub REST API using the automatically-provided GITHUB_TOKEN. They want to save the token value from one workflow run and reuse it later from a local script to avoid re-triggering the workflow. As the security reviewer, how should you respond regarding the nature of GITHUB_TOKEN?

A workflow in your repository builds a container image and then attempts to create a GitHub Release using a release step (for example the gh CLI). The workflow file contains a top-level `permissions:` block set to `contents: read` and no other scopes. The build steps succeed, but the release-creation step fails with a 403 error. Your security team requires you to grant only the minimum additional access needed for this job to succeed, without loosening the default token behavior elsewhere. What is the most appropriate change?

A workflow in the `web-app` repository needs to check out and read files from a separate private repository, `shared-config`, during its build. The engineer configures the default `GITHUB_TOKEN` with `contents: read` permission and passes it to the checkout step targeting `shared-config`, but the step fails with an authentication/permission error. What is the correct explanation and remediation?

A workflow builds a container image and pushes it to GitHub Container Registry (ghcr.io) using the automatically provided GITHUB_TOKEN. The workflow also runs a linter and a test job that only need to read repository contents. Your security team requires that the workflow follow least-privilege for the GITHUB_TOKEN. What is the most appropriate way to configure permissions?

Your team currently stores a long-lived AWS access key and secret in repository secrets to let a deployment workflow push artifacts to an S3 bucket. Security wants to eliminate stored cloud credentials entirely by using OpenID Connect (OIDC) federation with AWS IAM. Which combination of changes correctly configures the workflow to obtain short-lived AWS credentials via OIDC?

Your team deploys to Azure from a GitHub Actions workflow. Currently a long-lived Azure service-principal client secret is stored as a repository secret and passed to the azure/login action. Security wants to eliminate the stored secret by using OpenID Connect (OIDC) federation. You configure a federated credential on the Azure AD app registration and update the workflow to log in with the client ID, tenant ID, and subscription ID (no secret). The job now fails at the login step with an error indicating no OIDC token could be requested. Which change to the workflow is required to make OIDC federation work?

Your team deploys to Google Cloud from GitHub Actions using Workload Identity Federation to avoid storing a long-lived service-account key. The deploy job currently fails at the authentication step with an error indicating no OIDC token could be requested. Your workflow uses the official google-github-actions/auth action with the workload_identity_provider and service_account inputs correctly configured. Which change to the workflow is required to fix the authentication failure?

Your security team audits a workflow that uses a popular third-party action referenced as `uses: some-vendor/deploy-action@v3`. The team wants to protect the pipeline against a supply-chain attack in which the vendor's tag is repointed to a malicious commit, while still following GitHub's recommended practice for third-party actions. Which change should you make to the reference?

Your team builds a container image in a GitHub Actions workflow and generates a build provenance attestation using the actions/attest-build-provenance action. A separate deployment workflow, running on a self-hosted runner in your production cluster, must refuse to deploy any image whose provenance cannot be confirmed as built by your organization's repository. Which approach correctly enforces this in the deployment workflow?

A public repository runs a CI workflow triggered on pull_request. The security team is concerned that contributors submitting pull requests from forks could exfiltrate repository secrets or run malicious code with elevated permissions. The team wants forked PRs to still get automated build/test feedback, but any workflow run that needs secrets or write access must not execute automatically for first-time or untrusted contributors. Which configuration best addresses this concern with the least additional custom scripting?

A workflow triggered by pull_request builds a Docker image tagged with the source branch name. A security reviewer flags this step because a malicious contributor could craft a branch name to execute arbitrary commands on the runner: ```yaml - name: Build image run: docker build -t myapp:${{ github.head_ref }} . ``` Which change most effectively eliminates the script injection risk while keeping the branch name available to the step?

A workflow triggered by `issues` runs the following step to log the new issue title: ```yaml - name: Log issue run: echo "New issue: ${{ github.event.issue.title }}" ``` A security reviewer flags this as a script injection risk because an attacker can craft an issue title containing shell metacharacters. Which change most effectively eliminates the injection vulnerability while preserving the logging behavior?

A workflow triggered by pull_request builds a comment summarizing the PR. A step contains: `run: echo "PR says: ${{ github.event.pull_request.body }}"`. A security review flags this as a script-injection vector because an attacker can place shell metacharacters in the PR body. Which change most effectively mitigates the injection risk while still using the value in the run step?

Your team needs to add a third-party action from the GitHub Marketplace to a production deployment workflow. Security policy requires you to minimize supply-chain risk when selecting and referencing the action. Among the following candidates, which represents the MOST trustworthy choice to adopt?

Your team builds a container image in a CI workflow and generates a build provenance attestation using the actions/attest-build-provenance action. Before the deploy job pulls and runs the image in production, you want to confirm that the image was genuinely produced by your trusted workflow and has not been swapped or tampered with. Which step correctly verifies the attestation as part of the deployment gate?