# GitHub and CI/CD security: keep untrusted changes away from deployment authority

Source: https://www.web3sec.news/blog/github-ci-security-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory trigger, checkout, inputs, runner and permissions for every workflow.
- [ ] Pin and review external actions and reusable workflows.
- [ ] Separate validation from release secrets and runners.
- [ ] Restrict cloud identity exchange to the intended workflow context.
- [ ] Test hostile text, unauthorized branches and compromised-action response.

## References
- [GitHub: secure use of Actions](https://docs.github.com/en/actions/reference/security/secure-use)
- [GitHub: OpenID Connect for workflows](https://docs.github.com/en/actions/concepts/security/openid-connect)