GitHub Actions Overview

<p>./.github/workflows/{filename} (C)</p> Signup and view all the answers

<p>Four (A)</p> Signup and view all the answers

<p>Triggers, Jobs, Steps (A)</p> Signup and view all the answers

<p>Push events, Manual triggers, Scheduled tasks (C)</p> Signup and view all the answers

<p>Secrets (B)</p> Signup and view all the answers

<p>To create dependencies between jobs (A)</p> Signup and view all the answers

<p>Run jobs with various configurations (D)</p> Signup and view all the answers

<p>By caching dependencies (A)</p> Signup and view all the answers

<p>Infrastructure as Code (C)</p> Signup and view all the answers

<p>To track vulnerabilities and update actions (B)</p> Signup and view all the answers

<p>Using structured data like JSON as secrets (D)</p> Signup and view all the answers

<p>Redaction is not guaranteed for transformed values (A)</p> Signup and view all the answers

<p>Audit and review secret usage regularly (B)</p> Signup and view all the answers

<p>By using actions instead of inline scripts (B)</p> Signup and view all the answers

<p>They can view secrets without restrictions (A)</p> Signup and view all the answers

<p>Registering derived secrets as public information (D)</p> Signup and view all the answers

<p>Utilize workflow templates for vulnerability detection (B)</p> Signup and view all the answers

<p>Label runners as self-hosted or GitHub-hosted (B)</p> Signup and view all the answers

<p>To eliminate the need for storing long-lived credentials (D)</p> Signup and view all the answers

<p>Pin actions to a tag only if the creator is trusted (A)</p> Signup and view all the answers

<p>Increased exposure to attacks from untrusted code (C)</p> Signup and view all the answers

<p>Just-in-Time (JIT) Runners (C)</p> Signup and view all the answers

<p>It can be stolen and used to modify repositories (D)</p> Signup and view all the answers

<p>They have broader access rights, increasing security risks (B)</p> Signup and view all the answers

<p>Using Dependabot (D)</p> Signup and view all the answers

<p>Accidental leaks of sensitive information (B)</p> Signup and view all the answers

<p>A workflow that invokes another reusable workflow (A)</p> Signup and view all the answers

<p>Limit access to sensitive environments (C)</p> Signup and view all the answers

<p>To centralize common tasks and avoid code duplication. (D)</p> Signup and view all the answers

<p>A reusable workflow can include multiple jobs that must run in a specific order. (A)</p> Signup and view all the answers

<p>The entire called workflow is executed as part of the caller workflow. (B)</p> Signup and view all the answers

<p>They allow passing values from the caller workflow to the called workflow. (C)</p> Signup and view all the answers

<p>More complex workflow creation. (C)</p> Signup and view all the answers

<p>Actions in the called workflow will run using the context of the caller workflow. (A)</p> Signup and view all the answers

<p>The caller workflow inherits the context of the called workflow. (B)</p> Signup and view all the answers

<p>It creates standardized methods to implement common tasks. (A)</p> Signup and view all the answers

<p>They allow testing and maintenance to be streamlined across all workflows. (B)</p> Signup and view all the answers

<p>A single line reference is used to invoke the entire called workflow. (C)</p> Signup and view all the answers

A type of workflow that can be reused across multiple workflows, allowing for code modularity and sharing.

They are defined with the 'on.workflow_call' trigger in the '.github/workflows' directory of a repository.

They can be referenced from a caller workflow using the 'uses' keyword in a job.

You pass them as inputs and secrets using the 'with' and 'secrets' keywords when referencing the reusable workflow.

They can be nested up to four levels deep.

Data that is required for an action to run. For example, file paths or specific configurations.

The results or output of an action that can be used in further processes.

An automated process defined in a YAML file that runs jobs and can be triggered by events, schedules, or manual actions.

Events that start a workflow. Examples include pushing code, creating a pull request, or triggering a specific schedule.

Securely store sensitive data like passwords and tokens. Use as environment variables in workflows to access this data when needed.

Run jobs in a workflow with different configurations, such as various versions of a software.

Optimize workflows by caching frequently used files to improve performance and reduce execution time.

A workflow that triggers the execution of another workflow, acting as the initiator.

A method for securely accessing cloud services using short-lived, scoped tokens, eliminating the need to store long-lived credentials.

A temporary, isolated environment in which GitHub Actions workflows are executed, minimizing the risk of persistent compromise.

Ephemeral, temporary runners designed to execute a single job before being removed, enhancing security.

Runners that are managed and controlled by the user, potentially increasing security risks if not properly secured.

A unique identifier for each commit in a repository, ensuring immutability and preventing backdoor risks from action updates.

A GitHub feature used to automatically keep actions and workflows up-to-date, improving security and reducing manual maintenance.

A token specifically granted to a repository, providing limited access and enhancing security.

Tokens issued to GitHub Apps, offering a more secure alternative to personal access tokens and SSH keys.

The practice of calling a reusable workflow from another workflow, similar to how functions are called

The dependencies between jobs within a reusable workflow. For example, a 'Deploy' job might depend on

When a reusable workflow is called, the caller workflow's context, including variables

Inputs are used to provide values to a reusable workflow from the caller workflow.

Secrets are used to share secure information with a reusable workflow.

The dependency graph in GitHub Actions visually represents the relationships between workflows.

Inputs and secrets can be defined in the reusable workflow using the 'inputs' and 'secrets' properties.

Specify if you're using self-hosted or GitHub-hosted runners for your workflows.

Encrypted values stored securely in GitHub, minimizing accidental exposure.

GitHub attempts to remove secrets from logs, preventing accidental exposure.

Avoid storing structured data (JSON, XML) as secrets due to complexities in redacting.

Register derived secrets (e.g., JWT generated from a secret) to track their exposure.

Regularly check how secrets are used and ensure they are properly redacted in logs.

Ensure workflows use credentials with the minimum necessary permissions.

Periodically change secrets and remove those that are no longer needed.

Only users with write access to a repository can view secrets.

Use CODEOWNERS to designate trusted reviewers for workflow changes, enhancing security.

Consider requiring approval for environment secrets, enhancing their security.

Untrusted inputs in workflows can lead to script injection vulnerabilities.

Use actions instead of inline scripts to minimize code execution vulnerabilities.

Use environment variables for untrusted inputs to prevent shell script injection.

Ensure defensive programming when handling potentially untrusted input.

Use workflow templates for code scanning (e.g., CodeQL) to find security vulnerabilities early.

Limit the permissions of tokens used in workflows to minimize security risks.