{
  "accessed": "2026-07-22",
  "sources": [
    {
      "name": "GITHUB_TOKEN concept",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/concepts/security/github_token",
      "needles": [
        "At the start of each workflow job, GitHub automatically creates a unique `GITHUB_TOKEN` secret",
        "expires when the job finishes"
      ]
    },
    {
      "name": "GITHUB_TOKEN workflow authentication",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/tutorials/authenticate-with-github_token",
      "needles": [
        "access the `GITHUB_TOKEN` through the `github.token` context even if the workflow does not explicitly pass",
        "least required access"
      ]
    },
    {
      "name": "workflow permissions syntax",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/reference/workflows-and-actions/workflow-syntax",
      "needles": [
        "You can use `permissions` either as a top-level key",
        "If you specify the access for any of these permissions, all of those that are not specified are set to `none`"
      ]
    },
    {
      "name": "fork pull-request behavior",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/reference/workflows-and-actions/events-that-trigger-workflows",
      "needles": [
        "secrets are not passed to the runner when a workflow is triggered from a forked repository",
        "The `GITHUB_TOKEN` has read-only permissions in pull requests from forked repositories"
      ]
    },
    {
      "name": "secure use reference",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/reference/security/secure-use",
      "needles": [
        "must not explicitly check out untrusted code",
        "treat artifacts uploaded from other workflows with caution"
      ]
    },
    {
      "name": "OIDC reference",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/reference/security/oidc",
      "needles": [
        "define at least one condition",
        "Without `id-token: write`"
      ]
    },
    {
      "name": "deployment environments",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments",
      "needles": [
        "deployment protection rules",
        "required reviewers"
      ]
    },
    {
      "name": "artifact attestations",
      "url": "https://docs.github.com/api/article/body?pathname=/en/actions/concepts/security/artifact-attestations",
      "needles": [
        "verify where and how your software was built",
        "cryptographically signed"
      ]
    },
    {
      "name": "action pinning guidance",
      "url": "https://docs.github.com/api/article/body?pathname=/en/code-security/tutorials/secure-your-organization/protect-against-threats",
      "needles": [
        "Pin third-party actions to commit SHAs",
        "exact code you reviewed and approved"
      ]
    }
  ]
}