Using GitHub's security features to secure your use of GitHub Actions

About GitHub's security features

GitHub provides many features to make your code more secure. You can use GitHub's built-in features to understand the actions your workflows depend on, ensure you are notified about vulnerabilities in the actions you consume, or automate the process of keeping the actions in your workflows up to date. If you publish and maintain actions, you can use GitHub to communicate with your community about vulnerabilities and how to fix them. For more information about security features that GitHub offers, see GitHub 安全功能.

This article will explain how you can use some of GitHub's security features to increase the security of your use of GitHub Actions.

Understanding dependencies in your workflows

You can use the dependency graph to explore the actions that the workflows in your repository use. The dependency graph is a summary of the manifest and lock files stored in a repository. It also recognizes files in ./github/workflows/ as manifests, which means that any actions or workflows referenced using the syntax jobs[*].steps[*].uses or jobs.<job_id>.uses will be parsed as dependencies.

The dependency graph shows the following information about actions used in workflows:

• The account or organization that owns the action.
• The workflow file that references the action.
• The version or SHA the action is pinned to.

In the dependency graph, dependencies are automatically sorted by vulnerability severity. If any of the actions you use have security advisories, they will display at the top of the list. You can navigate to the advisory from the dependency graph and access instructions for resolving the vulnerability.

Enterprise owners can configure the dependency graph and Dependabot alerts for an enterprise. For more information, see 为企业启用依赖项关系图.

Being aware of security vulnerabilities in actions you use

For actions available on the marketplace, GitHub reviews related security advisories and then adds those advisories to the GitHub Advisory Database. You can search the database for actions that you use to find information about existing vulnerabilities and instructions for how to fix them. To streamline your search, use the GitHub Actions filter in the GitHub Advisory Database.

You can set up your repositories so that you:

• Receive alerts when actions used in your workflows receive a vulnerability report. For more information, see Monitoring the actions in your workflows.
• Are warned about existing advisories when you add or update an action in a workflow. For more information, see Screening actions for vulnerabilities in new or updated workflows.

Monitoring the actions in your workflows

You can use Dependabot to monitor the actions in your workflows and enable Dependabot alerts to notify you when an action you use has a reported vulnerability. Dependabot performs a scan of the default branch of the repositories where it is enabled to detect insecure dependencies. Dependabot generates Dependabot alerts when a new advisory is added to the GitHub Advisory Database or when an action you use is updated.

An enterprise owner must first set up Dependabot for your enterprise before you can manage Dependabot alerts for your repository. For more information, see 为企业启用 Dependabot.

你可以在存储库的 Dependabot alerts 选项卡中查看所有打开和关闭的 Dependabot alerts 以及对应的 Dependabot security updates。 For more information, see 查看和更新 Dependabot 警报.

Screening actions for vulnerabilities in new or updated workflows

When you open pull requests to update your workflows, it is good practice to use dependency review to understand the security impact of changes you've made to the actions you use. 依赖项审查帮助您了解依赖项变化以及这些变化在每个拉取请求中的安全影响。 它提供了一个易于理解的依赖项变化可视化效果，多差异显示在拉取请求的“更改的文件”选项卡上。 依赖项审查告知您：

• 与发行日期一起添加、删除或更新的依赖项有哪些
• 有多少项目使用这些组件
• 这些依赖项的漏洞数据

If any of the changes you made to your workflows are flagged as vulnerable, you can avoid adding them to your project or update them to a secure version.

For more information about dependency review, see 关于依赖项评审.

“依赖项审查操作”指的是可以在 GitHub Actions 上下文中报告拉取请求差异的具体操作。 请参阅 dependency-review-action。 可使用存储库中的 依赖项审查操作 对拉取请求强制实施依赖项审查。 该操作会扫描拉取请求中包版本更改引入的易受攻击的依赖项版本，并警告你相关的安全漏洞。 这样可以更好地了解拉取请求中发生的变化，并帮助防止漏洞添加到存储库中。 For more information, see 关于依赖项评审.

Keeping the actions in your workflows secure and up to date

可使用 Dependabot 来确保对存储库中使用的操作和可重用工作流的引用保持最新。 操作通常使用漏洞修复和新功能进行更新，以使自动化流程更快速、更安全、更可靠。 Dependabot 使你无需维护依赖项，因为其会自动执行此操作。 有关详细信息，请参阅 使用 Dependabot 保持操作的最新状态 和 关于 Dependabot 安全更新。

The following features can automatically update the actions in your workflows.

• Dependabot version updates open pull requests to update actions to the latest version when a new version is released.
• Dependabot security updates open pull requests to update actions with reported vulnerabilities to the minimum patched version.

For information on how to configure Dependabot version updates, see 配置 Dependabot 版本更新.

For information on how to configure Dependabot security updates, see 配置 Dependabot 安全更新.