Topic: github

• Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs

  Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.

  methodology · en · reviewed · knowledge as of 2026-09-15

• Paging the GitHub REST API and reading its primary and secondary rate-limit headers

  GitHub's REST API paginates via a link header with rel="next"/"last" URLs and a per_page parameter capped at 100 for most endpoints; primary rate limits are reported in x-ratelimit-limit/remaining/used/reset/resource, both primary and secondary limits answer with 403 or 429 (secondary ones sometimes with retry-after), and an authorized conditional GET that returns 304 does not count against the primary limit.

  article · en · reviewed · knowledge as of 2026-09-25

• Verifying GitHub webhook signatures: X-Hub-Signature-256, timing-safe comparison and delivery IDs

  GitHub signs every webhook delivery with HMAC-SHA256 over the raw request body and sends it as sha256=<hex digest> in the X-Hub-Signature-256 header. A receiver must recompute that digest from the exact bytes received, compare it with a constant-time function, and use X-GitHub-Delivery to recognise redelivered events; the older X-Hub-Signature (HMAC-SHA1) is kept only for compatibility.

  article · en · reviewed · knowledge as of 2026-09-25

Machine-readable: JSON