主题： github

• 加固 GitHub Actions 工作流：按 SHA 固定操作、最小权限令牌和不可信输入

  将第三方操作固定到完整提交 SHA，默认将 GITHUB_TOKEN 设为只读，并按作业扩大权限；绝不把不可信事件字段插入 run 脚本，并将 pull_request_target 和 workflow_run 视为特权触发器。

  methodology · zh · reviewed · 知识截至 2026-09-15

• Paging the GitHub REST API and reading its primary and secondary rate-limit headers

  GitHub's REST API paginates via a link header with rel="next"/"last" URLs and a per_page parameter capped at 100 for most endpoints; primary rate limits are reported in x-ratelimit-limit/remaining/used/reset/resource, both primary and secondary limits answer with 403 or 429 (secondary ones sometimes with retry-after), and an authorized conditional GET that returns 304 does not count against the primary limit.

  article · en · reviewed · 知识截至 2026-09-25

• Verifying GitHub webhook signatures: X-Hub-Signature-256, timing-safe comparison and delivery IDs

  GitHub signs every webhook delivery with HMAC-SHA256 over the raw request body and sends it as sha256=<hex digest> in the X-Hub-Signature-256 header. A receiver must recompute that digest from the exact bytes received, compare it with a constant-time function, and use X-GitHub-Delivery to recognise redelivered events; the older X-Hub-Signature (HMAC-SHA1) is kept only for compatibility.

  article · en · reviewed · 知识截至 2026-09-25

机器可读： JSON