Permissions And Secrets

# VULNERABLE: No explicit permissions — inherits repo default
on: pull_request
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "What permissions does GITHUB_TOKEN have?"

# SAFE: Explicit minimal permissions at workflow level
on: pull_request
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: echo "GITHUB_TOKEN can only read"

# DANGEROUS: write-all grants everything
permissions: write-all

# DANGEROUS: Broad permissions on untrusted trigger
on: pull_request_target
permissions:
  contents: write
  pull-requests: write
  packages: write

# SUSPICIOUS: id-token on workflows that don't deploy
on: pull_request
permissions:
  id-token: write  # Why does a PR build need OIDC?

# VULNERABLE: Secret value ends up in shell where injection can capture it
env:
  API_KEY: ${{ secrets.API_KEY }}
steps:
  - run: echo "Processing ${{ github.event.pull_request.title }}"
    # Expression injection here can access $API_KEY from environment

# VULNERABLE: Derived values from secrets may not be masked
- run: |
    ENCODED=$(echo "${{ secrets.API_KEY }}" | base64)
    echo "Encoded key: $ENCODED"  # GitHub only masks the original secret value

# VULNERABLE: Secrets written to files that become artifacts
- run: |
    echo "${{ secrets.DEPLOY_KEY }}" > deploy_key.pem
    # If this file ends up in an artifact, the secret is exposed
- uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: .  # Includes deploy_key.pem!

# VULNERABLE: Fork code can access org secrets
on: pull_request_target
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - run: ./build.sh  # Fork code can read all secrets via ${{ secrets.* }}

# Find workflows without explicit permissions
grep -L "permissions:" .github/workflows/*.yml

# Find workflows with write-all
grep -rn "write-all" .github/workflows/

# Find workflows with broad write permissions
grep -rn "write$" .github/workflows/ | grep -v "#"

# Find secret usage
grep -rn "secrets\." .github/workflows/

# Find secrets in pull_request_target workflows
for f in .github/workflows/*.yml; do
  if grep -q "pull_request_target" "$f" && grep -q "secrets\." "$f"; then
    echo "ALERT: $f uses secrets with pull_request_target"
  fi
done

# Find workflows that write secrets to files
grep -A2 "secrets\." .github/workflows/*.yml | grep -E ">\s|>>|tee "

# Check for environment-level secrets
grep -rn "environment:" .github/workflows/

# VULNERABLE: Subject claim too broad — any branch can assume role
# AWS IAM trust policy
{
  "Condition": {
    "StringLike": {
      "token.actions.githubusercontent.com:sub": "repo:org/repo:*"  # Any ref!
    }
  }
}

# SAFE: Restrict to specific branch and environment
{
  "Condition": {
    "StringEquals": {
      "token.actions.githubusercontent.com:sub": "repo:org/repo:environment:production"
    }
  }
}

# Set restrictive defaults at workflow level
permissions:
  contents: read

# Override per-job only when needed
jobs:
  lint:
    runs-on: ubuntu-latest
    # Inherits workflow permissions: contents: read
    steps:
      - uses: actions/checkout@v4
      - run: npm run lint

  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # Only this job needs OIDC
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production  # Secrets only available in this environment
    steps:
      - run: deploy --key ${{ secrets.DEPLOY_KEY }}