Lion Cipher Lab
Harden a GitHub Actions Workflow (Supply-Chain & Privilege)
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Your CI pipeline runs with a token that can push code, publish releases, and open pull requests, and it usually holds your cloud and package-registry secrets. Attackers know this: in March 2025 the popular tj-actions/changed-files action (CVE-2025-30066) was backdoored to dump CI secrets into public build logs across tens of thousands of repositories, and in 2021 the Codecov bash-uploader was tampered with to exfiltrate environment variables (secrets) from customers' pipelines. A pipeline is production. This lab teaches you to lock one down the way a professional does — and to prove it with a…
What you'll learn
- Reading and writing GitHub Actions workflow YAML
- Least-privilege GITHUB_TOKEN permissions
- Pinning actions to a full commit SHA
- Spotting and fixing CI script injection
- Recognizing pull_request_target attacks
- Auditing workflows locally with actionlint and zizmor
- The case for OIDC over long-lived cloud secrets
Steps in this lab
- The five words you need: workflow, job, step, action, GITHUB_TOKEN
- Install the two linters (pick Docker OR pipx)
- Create the deliberately-insecure workflow
- Audit the insecure file — see the findings for yourself
- Fix 1 — least-privilege permissions for the GITHUB_TOKEN
- Fix 2 — pin third-party actions to a full commit SHA
- Fix 3 — stop script injection: pass untrusted input via env
- Fix 4 — neutralize the pull_request_target trigger
- Assemble hardened.yml and re-audit
- The pro move: OIDC instead of long-lived cloud secrets
- What you just did — and why it sticks