Lion Cipher Lab

Secure a GitHub Actions pipeline

• AppSec / DevSecOps
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Your CI/CD pipeline is one of the most powerful things attached to your code, and one of the least guarded. Every push, it wakes up holding a token that can write to your repository, it can read the secrets you use to deploy, and it runs third-party code you pulled in with a single line. That combination -- privilege, secrets, and untrusted code -- is exactly why pipelines are a favourite supply-chain target: compromise one action, or trick one workflow, and you inherit the token and the secrets without ever touching the developers' laptops. The defences are unglamorous and they work: pin the…

What you'll learn

• securing CI/CD pipelines
• GitHub Actions workflow hardening
• pinning actions to a commit SHA
• least-privilege GITHUB_TOKEN permissions
• handling secrets safely in CI
• preventing script injection from untrusted input
• adding a security scan step
• supply-chain risk awareness

Steps in this lab

1. The words first: CI/CD, workflow, action, and the token
2. Open a repo you own and find (or create) a workflow
3. Give the token the least privilege that works
4. Pin every third-party action to a full commit SHA
5. Keep secrets in encrypted storage, and out of the logs
6. Never splice untrusted input into a run: command
7. Add a security scan step on every push
8. The instinct you just built

Open the full interactive lab →