Best practices for securing GitHub CI workflows

[magajh]

Securing GitHub CI Pipelines

from https://openedx.atlassian.net/wiki/spaces/COMM/pages/3963420755/Discovery+Document+Integrating+Security+Suites+into+GitHub+CI+for+Open+edX#Next-Steps

Obj: To safeguard GitHub CI pipelines against potential security threats.

Action Plan:

• Investigation: Conduct a thorough investigation of the current GitHub CI pipelines to identify any security vulnerabilities.
• Documentation: Develop a comprehensive document outlining minimum security requirements and best practices for securing GitHub CI workflows within the organization.
• Tool Evaluation: Explore and evaluate (if any) tools that could improve the security of GitHub CI pipelines.

Some links that might be helpful:

• https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
• https://blog.gitguardian.com/github-actions-security-cheat-sheet/
• https://github.com/myugan/awesome-cicd-security