GitHub Actions 安全与 Secret 管理：权限控制、OIDC 认证、审计与最佳实践

# ❌ 危险：默认赋予所有权限
# （不设置 permissions 时，默认读写所有内容）

# ✅ 推荐：显式声明最小权限
permissions:
  contents: read           # 只读代码
  pull-requests: write     # 仅 PR 操作
  id-token: write          # OIDC Token（云认证）

jobs:
  deploy:
    permissions:
      contents: read
      packages: write      # 推送容器镜像
      id-token: write

# 在组织级别限制默认权限
# GitHub Organization → Settings → Actions → General
# Default workflow permissions: Read repository contents and packages permissions

# ✅ 正确：env 注入，避免命令行回显
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      API_KEY: ${{ secrets.API_KEY }}
    steps:
      - run: |
          curl -H "Authorization: Bearer $API_KEY" https://api.example.com

# ❌ 危险：直接在命令行使用（部分 CI 系统会回显）
# - run: curl -H "Authorization: Bearer ${{ secrets.API_KEY }}" ...

permissions:
  id-token: write
  contents: read

jobs:
  deploy-aws:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
          aws-region: us-east-1
          role-duration-seconds: 1200  # 临时凭证有效期

      - run: aws s3 sync ./dist s3://my-bucket

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Federated": "arn:aws:iam::123456789:oidc-provider/token.actions.githubusercontent.com" },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
      "StringLike": { "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:*" }
    }
  }]
}

- name: Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: GCP Auth
  uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/123/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
    service_account: 'github-actions@my-project.iam.gserviceaccount.com'

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    reviewers:
      - "octocat"

name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [ cron: '0 9 * * 1' ]

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript, typescript
      - uses: github/codeql-action/analyze@v3

- run: npm audit --audit-level=moderate
- run: npm audit fix --dry-run  # 查看建议修复

- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
  with:
    base64-subjects: "${{ hashFiles('dist/**') }}"

jobs:
  deploy-production:
    runs-on: [self-hosted, production]  # 标签限制