GitHub Actions Secrets: Security Best Practices

in this video I'm going to show you some good security practices for using GitHub action Secrets properly and safely hey welcome back I'm current Dave and here we try and do devops just better today we talk about security and specifically about how to properly use and configure GitHub action Secrets this video is part of a new GitHub security hardening series check out the playlist for more video related to this also if you're new to GitHub actions I recommend you to check the other video I made about the topic because there cover all you can do

with GitHub actions and more alright so let's talk secrets we hopefully all agree that sensitive values should never be stored as plain text in workflow files but rather as a secret and secrets can be configured at the Enterprise organization repository or environment level allow you to store sensitive information in GitHub as I explained in another video you can find a link up here in the video description and storing these secrets is not a problem usually as everything is safely managed by GitHub they are even encrypted on the client's side before reaching GitHub however using them

can be problematic to help prevent accidental leakages in fact GitHub reducts any secret that appear in run logs and replace their value with stars this reduction looks for exact matches of any configured secret as well as common encodings of the values like for example base64. their heart their heart there are however multiple ways in which a secret value can be transformed and because of that this reduction is not 100 guaranteed as a result there are some things we can do proactively and good practices we should follow to help ensure circuits are reducted and to limit

other risks associated with secrets so first of all if possible don't use structured data as a secret using structured data can in fact cause secret reduction within logs to fail as reduction as we've seen rely on identify and extract mesh of the secret value for example avoid using a blob of Json XML yaml or similar as ticket value because this significantly reduce the probability that the secrets will be properly reducted Instead try to create individual secrets for each sensitive value again this is not always possible but doing so greatly greatly reduced risks another important step

is to try and register all the secrets used within workflows if a secret is used to generate another sensitive value within the workflow that generated value should be formally registered as a secret this ensures that the value will be reducted if it ever appears in the log and for example when you use a private key to generate a signed jwd for accessing a web API it's important to register that jwd as a secret otherwise that JWT token won't be redacted if it ever enters the logged output it's important to note that registering Seekers also applies

to any sort of transformation or encoding for example if your circuit is transformed in any way let's say base64 or URL encoding be sure to register the new value as a secret as well and by the way let me know in the comments below if you'd like me to do a video on how to register anything as a secret in GitHub action in addition it is important to audit how secrets are handled this involves for example reviewing how secret are used to ensure they are being handled properly to do this you can review for example

the source code of the repository executing the workflow and check any action used in the workflow make sure that secrets are not sent to unintendent hosts or explicitly printed to log output after a testing valid and invalid inputs view the round logs for your workflow and confirm that secrets are probably reducted or not shown it is not always clear how a command or tool you're invoking will send errors to standard out on standard error and secrets may end up in error logs therefore it's a good practice to manually review the workflows log to ensure that

secrets are properly handled before we move on to the next tips and points to consider hit the like button below if you're enjoying this video or you find it insightful this will help this video still be seen by more people so they can benefit from it and of course that will mean a lot to me thank you next good practice and not only for GitHub action Secrets is using credentials that are minimally scoped what I mean is that you should ensure that credentials used in workflows have the minimum privileges needed keep in mind that any

user with the right access to your repository also has read access to all the secrets configured in it action can access the GitHub underscore token for example uh from the github.token context therefore you should ensure that the GitHub underscore talking is only granted the minimum required permissions it is good security practice to set the default permission for GitHub token to read access only for repository content the permission can be then increased for individual jobs within the workflow file as required another thing we should all do when working with secret is to audit and rotate register

secrets for example we can periodically review the register secrets to confirm they are still required and remove those that are no longer needed I personally said this is a recurring task for my team so every month or every two months we have a review of all secrets we should also rotate the secrets periodically to reduce the window of time during which an eventually compromised secret is valid and reduce exposure and final good practice consider requiring review for access to Secrets not everyone may be aware of this but you can use required reviewer to protect environment

Secrets a workflow job cannot access environment Secrets until our viewer grants approval this was of course only available in GitHub Enterprise or on public repositories but it's something you should definitely do if you can let me know in the comments below what you think about those tips and if you have any other tip that you normally apply for working with GitHub secrets and secrets in GitHub actions and also check out this video over here in which I talk about all the things you can do with GitHub actions but that's it for me thanks so much

for watching I really hope you enjoyed it hit the like button below subscribe if you haven't already and I see you in the next video here at Korea Dave [Music]