Using GitHub's security features to secure your use of GitHub Actions

About GitHub's security features

GitHub provides many features to make your code more secure. You can use GitHub's built-in features to understand the actions your workflows depend on, ensure you are notified about vulnerabilities in the actions you consume, or automate the process of keeping the actions in your workflows up to date. If you publish and maintain actions, you can use GitHub to communicate with your community about vulnerabilities and how to fix them. For more information about security features that GitHub offers, see Recursos de segurança do GitHub.

This article will explain how you can use some of GitHub's security features to increase the security of your use of GitHub Actions.

Understanding dependencies in your workflows

You can use the dependency graph to explore the actions that the workflows in your repository use. The dependency graph is a summary of the manifest and lock files stored in a repository. It also recognizes files in ./github/workflows/ as manifests, which means that any actions or workflows referenced using the syntax jobs[*].steps[*].uses or jobs.<job_id>.uses will be parsed as dependencies.

The dependency graph shows the following information about actions used in workflows:

The account or organization that owns the action.
The workflow file that references the action.
The version or SHA the action is pinned to.

In the dependency graph, dependencies are automatically sorted by vulnerability severity. If any of the actions you use have security advisories, they will display at the top of the list. You can navigate to the advisory from the dependency graph and access instructions for resolving the vulnerability.

Enterprise owners can configure the dependency graph and Dependabot alerts for an enterprise. For more information, see Habilitando o gráfico de dependências para a sua empresa.

Being aware of security vulnerabilities in actions you use

For actions available on the marketplace, GitHub reviews related security advisories and then adds those advisories to the GitHub Advisory Database. You can search the database for actions that you use to find information about existing vulnerabilities and instructions for how to fix them. To streamline your search, use the GitHub Actions filter in the GitHub Advisory Database.

You can set up your repositories so that you:

Receive alerts when actions used in your workflows receive a vulnerability report. For more information, see Monitoring the actions in your workflows.
Are warned about existing advisories when you add or update an action in a workflow. For more information, see Screening actions for vulnerabilities in new or updated workflows.

Monitoring the actions in your workflows

You can use Dependabot to monitor the actions in your workflows and enable Dependabot alerts to notify you when an action you use has a reported vulnerability. Dependabot performs a scan of the default branch of the repositories where it is enabled to detect insecure dependencies. Dependabot generates Dependabot alerts when a new advisory is added to the GitHub Advisory Database or when an action you use is updated.

Observação

Dependabot only creates alerts for vulnerable actions that use semantic versioning and will not create alerts for actions pinned to SHA values.

An enterprise owner must first set up Dependabot for your enterprise before you can manage Dependabot alerts for your repository. For more information, see Habilitando o Dependabot para sua empresa.

Você pode exibir todos os Dependabot alerts abertos e fechados e as Dependabot security updates correspondentes na guia Dependabot alerts do seu repositório. For more information, see Visualizando e atualizando alertas do Dependabot.

Screening actions for vulnerabilities in new or updated workflows

When you open pull requests to update your workflows, it is good practice to use dependency review to understand the security impact of changes you've made to the actions you use. Revisão de dependências ajuda você a entender as alterações de dependência e o impacto de segurança dessas alterações em cada pull request. Ele fornece uma visualização facilmente compreensível de mudanças de dependência, com um diff avançado na aba "Arquivos alterados" de uma solicitação de pull. A revisão de dependências informa você:

Quais dependências foram adicionadas, removidas ou atualizadas, junto com as datas de lançamento
Quantos projetos usam esses componentes
Dados de vulnerabilidade para essas dependências

If any of the changes you made to your workflows are flagged as vulnerable, you can avoid adding them to your project or update them to a secure version.

For more information about dependency review, see Sobre a análise de dependência.

O "ação de revisão de dependência" se refere à ação específica que pode relatar diferenças em um pull request dentro do contexto do GitHub Actions. Consulte dependency-review-action. É possível usar o ação de revisão de dependência no repositório para impor revisões de dependência em solicitações de pull. A ação examina versões vulneráveis de dependências introduzidas por alterações de versão do pacote em solicitações de pull e avisa você sobre as vulnerabilidades de segurança associadas. Isso oferece uma melhor visibilidade do que está mudando em uma solicitação de pull e ajuda a evitar que vulnerabilidades sejam adicionadas ao repositório. For more information, see Sobre a análise de dependência.

Keeping the actions in your workflows secure and up to date

Você pode usar o Dependabot para garantir que as referências a ações e a fluxos de trabalho reutilizáveis usados no seu repositório sejam mantidas atualizadas. Ações são frequentemente atualizadas com correções de bugs e novos recursos para tornar os processos automatizados mais rápidos, seguros e confiáveis. O Dependabot reduz o seu esforço para manter dependências, pois ele faz isso automaticamente para você. Para saber mais, confira Manter as suas ações atualizadas com o Dependabot e Sobre as atualizações de segurança do Dependabot.

The following features can automatically update the actions in your workflows.

Dependabot version updates open pull requests to update actions to the latest version when a new version is released.
Dependabot security updates open pull requests to update actions with reported vulnerabilities to the minimum patched version.