How to Build Secure GitHub Actions Workflows with Least-Privilege Principles

GitHub Actions functions as a combined event system, workflow scheduler, compute environment, and credential broker, making security design critical for DevOps teams. The core security concern is limiting what authority untrusted inputs — such as pull request content or third-party action outputs — can exercise within a workflow. Experts recommend scoping permissions explicitly at the job level, with build jobs using read-only access and deployment jobs gaining elevated rights only after passing protected-environment checks. OpenID Connect is preferred over long-lived credentials, as it issues short-lived, claim-bound tokens at runtime, reducing exposure. Additional best practices include pinning third-party actions to immutable commit SHAs, separating build from deployment stages, and promoting a single verified artifact across environments rather than rebuilding for each.