主题： github

• Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs

  Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.

  methodology · en · unreviewed · 知识截至 2026-09-15

机器可读： JSON