Securing GitHub Actions CI/CD: OIDC Token Exchange, Pinning Actions by SHA & Least Privilege

The Risk of Static Long-Lived Cloud Credentials

Storing static AWS Access Keys, Google Cloud JSON service accounts, or database passwords in GitHub Secrets exposes organizations to credential theft if a pull request or third-party action is compromised.

Modern OIDC Cloud Authentication

OpenID Connect (OIDC) allows GitHub Actions workflows to request short-lived, dynamically generated access tokens directly from cloud providers without storing permanent secrets:

permissions:
  id-token: write
  contents: read

steps:
  - name: Authenticate to AWS
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/GitHubDeployRole
      aws-region: af-south-1

Pinning Actions by Full Commit SHA

Never reference third-party actions by mutable Git tags (e.g., uses: actions/checkout@v4). Pin them to immutable commit SHAs (e.g., uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11) to prevent upstream supply chain poisoning.