github-actions

GitHub Actions Code Review Rules

Security (Critical)

• Expression Safety: Always sanitize or restrict values injected into ${{ }} expressions. Escape or validate all user-provided data before use. Never interpolate untrusted user input
• Variable Exposure: Do not expose or output ${{ }} expressions in workflow logs or error messages. Ensure all variables are declared and sourced safely
• Secret Management: Never echo secrets or use them in URLs as this can result in inadvertent disclosure. Always review log output and sanitize URLs to prevent leaks
• Pin actions to full commit SHA (not @v1 or @main)
• Use minimal permissions block (principle of least privilege)
• Use secrets.GITHUB_TOKEN instead of PATs when possible
• Audit third-party actions before use
• Validate all inputs to reusable workflows and custom actions