テーマ： github

• Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs

  Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.

  methodology · en · unreviewed · 知識の基準日 2026-09-15

機械可読： JSON