Security best practices for authors of GitHub Actions

Why Action Authors Need a Security Baseline

GitHub Actions has become a core part of modern software delivery. The latest Octoverse report shows a 169% increase in Actions minutes used in public repositories, and the Marketplace now hosts more than 20,000 Actions. With that growth comes a shared responsibility: the health of the ecosystem depends on the security of individual actions. If you author an action, the code you publish can be trusted and executed by workflows across thousands of repositories. The practices below cover the minimum steps you should take to protect your action, your repository, and the users who depend on it.

If you’re consuming Actions rather than authoring them, GitHub’s security hardening guide is the recommended reference for safe usage.

Harden the Source Repository

Your action’s source repository is a direct attack vector: anyone who compromises it can inject malicious code into every workflow that uses the action. The following measures address the most important repository-level risks.

Enable Dependabot

Dependabot continuously monitors project dependencies and flags updates or vulnerabilities as they are published. For Actions, this matters because a vulnerable dependency in your action can compromise not only your code but every workflow that references it. Dependabot checks your dependencies against the GitHub Advisory Database and alerts you to relevant risks. See the Dependabot setup documentation for configuration details.

Run Code Scanning

Dependabot covers external libraries; code scanning covers the code you write. It analyzes your source for vulnerabilities and security flaws. You can use CodeQL or any third-party scanner that outputs SARIF data. Full guidance is available in the code scanning documentation.

Triage Critical Alerts Promptly

Enabling the tools is only the start. You also need a process for reviewing and resolving critical alerts in a timely manner. Acting on findings is what actually reduces risk and signals to the community that your action is actively maintained.

Publish a Security Policy

A SECURITY.md file gives researchers and users a private channel to report vulnerabilities. Without one, security issues surface in public issue trackers, where attackers can exploit them before you have a chance to respond. Instructions for adding a policy are in the GitHub documentation.

Protect the Maintainer Account

Repository controls do not help if the maintainer’s account is compromised. An attacker with write access to a trusted action can distribute malicious updates to every downstream consumer. Require multi-factor authentication (MFA) on all GitHub accounts that can modify the action. MFA setup instructions are available in GitHub’s authentication guide.

Earn the Verified Badge

The verified creator badge in the Marketplace signals that GitHub has confirmed your organization as a partner. It helps users distinguish the official version of your action from lookalikes or forks. The badge is granted during onboarding to the Technology Partner Program. More details can be found in the Marketplace badge documentation.

GitHub has also published a curated list of partner Actions whose authors have self-attested to adhering to these practices. Future Marketplace support will eventually let you filter out Actions that do not meet the baseline.