Actions 安全：OIDC、最小权限与不可信 PR | GitHub

本章覆盖：OIDC；short-lived cloud credential；avoid long-lived cloud secret；`permissions`；untrusted fork pull request；`pull_request`；`pull_request_target` 高风险边界；action SHA pinning；dependency review；workflow code is production code；平台安全策略会持续演进，安全章节必须以当前官方文档复核。

本章知识点

  • OIDC
  • short-lived cloud credential
  • avoid long-lived cloud secret
  • permissions
  • untrusted fork pull request
  • pull_request
  • pull_request_target 高风险边界
  • action SHA pinning
  • dependency review
  • workflow code is production code
  • 平台安全策略会持续演进，安全章节必须以当前官方文档复核