Start with workflow trust
A CI/CD workflow can access source code, credentials and production systems. Treat every workflow permission and third-party action as part of your software supply-chain boundary.
1. Minimize permissions
Declare the smallest GitHub token permissions required by the workflow. A read-only workflow should not receive write access simply because another job needs it.
permissions:
contents: read2. Protect secrets
Keep deployment credentials in GitHub Secrets or an appropriate external secret-management system. Never commit credentials into workflow files, scripts or logs.
3. Review actions
Pin or otherwise govern third-party actions according to your organization's supply-chain policy. Understand what code executes with your workflow permissions.
4. Separate deployment trust
Use protected environments, approvals and scoped credentials where the deployment path requires stronger controls.
Security model
Commit → Workflow → Permissions → Build → Artifact → DeploymentEvery transition is a trust boundary. Make the access required at each step explicit and observable.