Santosh Yadav: GitHub Actions Best Practices

This talk focuses on best practices for using GitHub Actions, emphasizing the importance of proactive measures in maintaining security and efficiency. The speaker reviews the fundamentals of GitHub Actions, which is a build tool that automates workflows based on GitHub events. Best practices begin from the initial organization setup, including managing user access by leveraging teams instead of adding individual users. The speaker discusses the use of branch protection rules, the necessity of utilizing specific SHA versions for actions, and the importance of auditing third-party actions regularly. Additionally, the talk highlights GitHub's fine-grained personal access tokens and environment-level secrets as crucial elements for securing workflows. Finally, a demo of GitHub Copilot workspaces illustrates how to streamline GitHub Actions creation effectively.

[Music] ladies and Gentlemen please welcome our next speaker santav presenting the topic GitHub actions best practices hey everyone good morning and thanks for coming at 10:00 talk I know it's too early nice to be here I I was here last year as well how many of you were here last year can you raise your hand oh not not much okay so last year I gave a talk

about GitHub actions so it was like getting started with GitHub action and when the organizers reached out to me again to give a talk I was like okay I think I should continue with the same talk where I left so GitHub actions getting started now it's best practices and I try to keep it short because there are so many things to learn about GitHub actions best practices

when it comes to best practices basically so uh of course there are more to learn I'll throw some links uh at the end some references so you can learn more and let's go ahead and get started uh with the talk GitHub actions best practices and at the end I have also a demo for GitHub co-pilot workspaces how many of you have access to GitHub co-pilot workspaces and

you tried it okay so some of you have access but never tried it so there'll be a cool demo like writing a gab actions so little bit about myself I'm a senior software engineer at salonis U that's what uh that's where I get my money from and um I'm a GD for angular and anx Champion I'm also a GitHub star so I get to interact a lot

with GitHub team and of course angular team as well I'm also co-founder of a community called This is learning we just did our first virtual conference last week wow just a week ago and uh we are planning for next Edition 2025 that will be virtual as well but just in case you are interested to appear on a podcast we also do a podcast called this ISR talks

just reach out to me on X or LinkedIn I'm there at SOS yadav Dev and I'm also on GitHub probably that's why they made me a so let's talk about what is GitHub actions first right before jumping into the best practices so we know like it's a build tool to automate your work close that's that's what we all of us know right that's what we do how

many of you actually use G back Network oh my God I'm scared now okay so GitHub actions of course we can run workflows for any GitHub event right so you can have your merge pull push U even if your issues are created your pull requests are created so you can actually handle all those events and run some jobs right that's what we do that's why we are

being paid and uh we can use any workflow run our workflow on any machine now thanks to GitHub that now Mac OS is open source as well so in case you are running your workflows U and you have an open source project you can now use Mac OS as well ear it was mostly Linux but you know there are some limitations which you can do with Linux

so Mac comes handy and of course there is Windows for some reason okay so it also supports matri Matrix and I think the demo I'm going to show you will see we see like how we can create Matrix as well and you can also write your custom actions that's that's how people steal data right just kidding don't do that so best practices uh is is Tri tricky

topic right I mean it's actually starts from the day you create your organization on GitHub so it's not like something which you have to do after your data is stolen you have to follow it from the day one but few things to remember about best practices as I said best practices starts from day one but be productive because best practices can change the same thing which was

best practice 2 years ago might not be the same the best practice two years after right so we all know that so be be proactive whenever you are following best practices and how of course we are going to talk about it so let's see uh the first thing everything starts from the axis right so if you're if you're not keeping an watch on your gab actions what

can happen of course probably uh your data is stolen and then your company shuts down right so I think the same thing happened with one of the password management companies few years ago right I don't want to take names I mean I don't remember it basically but I don't want to take names so uh whenever you start creating your GitHub organization or you start setting up your

GitHub organization this is one thing people do they start adding individuals right because that's something which is easy to do but remember things which are easy to do is not the best choice right I mean it may fire back and this is why you should it it's okay if takes time uh but try to give access to teams set up your teams properly so you don't have

to worry about like who is leaving your teams and you have to remove all this those users manually otherwise they go to another company and steal your code and become Millionaire right so how you can do that of course get a uh.com you can just go to collaborators and teams and then you can start adding you can see two tabs right so basically there is I don't

know how this things work okay so but you can see there's something called add people and add teams try to have fewer admins I mean if you're adding people of course probably you may need to because there will be some admins you can add actually few admins and rest of them goes as teams and now you can actually do multiple things here um many of the people

who use Azure they use Azure ad right so you can create your teams on Azure ad and then singap with the GitHub actions that's a good way that's what we do at sonon is we don't have teams like we don't create teams directly we create it in GI up sorry Azure first and then we create or add those teams here so we it's easy to manage so

when someone leaves the organization they are removed from the Azure ID and they don't have access anymore and we don't have to sync up all the things manually get up uh also launched Branch protection rules last year how many of you are using it anyone very few right of course I know Michael so you should do that there are uh things like of course I can I

can show you how it looks like just in case U you never used it so you can actually set up I don't know why this is looking blurred it's blurry right ah okay so it's okay so but you can see there are so many things which you can set up as your branch protection rules there are few important things for example required uh signed commits this is

very important because you know there are there have been instances of people's come people actually faking or like imitating someone else who is not actually the commit author but um making sure the required commits are on for all the users will be a great addition in case you're planning to create a br Branch protection rules set it for your master so no one can delete it so

there are so many checks here for example uh this check right rules apply to everyone including an administrator so allow Force push and allow deletions be safe don't do that and uh you can also set like who can push to the branches this is very handy in case you putting Branch protection rule on your master so no one can push but you want to allow admins right

that's what we do uh some admins have access so you can actually probably add teams here as well in case you have an admin team you can actually just add them and they can push the code to the Masters or a release Branch basically and this is this is how it looks like Branch protection rules I mean start go ahead and start using it this is very

uh good way to secure your giup actions as well we know we know this like use trusted actions but how like because there are so many actions which is very handy for us right for for example um if you want to you uh solve some use cases for example creating your release noes right of course github.com also has an way you can just create it manually but

who does the manual thing right we will just West 10 hours automating the task we can do it in one minute that's why we are developers so uh you uh always see this permission so in case you go to GitHub and of course all these are actually part of the settings so you will find something called actions permission and you can see allow all actions and reusable

workflows are actually enabled by by default and U you can change the settings so you can see there are multiple options which are available so uh be safe like which actions you want to allow and which you and one more thing uh when it comes to GitHub actions use specific sha I mean just to ask how many of you are actually using sha on GitHub actions no

one right even not me but yeah you should do that I mean there have been instances where I mean of course if this action is provided by GitHub we know that that's secure but if this is a third party action there are multiple ways people can uh hack your data right I mean you know what happened with XZ Zan right he's very famous now everyone knows knows

his name but never saw him W what a person so try to use shavan so no one if there is any vulnerability you can always like there is no threat to your organization basically you you can just roll back to the previous version just in case something comes up and this is how you can do it so if you see um I have a action setup node

uh which where I've just written shaan basically of course I don't want it to copy paste the shavan so whenever you are passing any actions just use the shaan even with the giab actions I think that's safe to use of course uh when or the actions by GitHub when they release a new new version basically they're super fast basically U might you might have used the um

recent one for uploading and downloading artifacts like the version 4 is really fast in case you are still on V3 I would recommend going to uh V4 for artifacts it's just much much faster V3 one thing audit third party actions we generally don't do that right I mean this is part of the best practice this is where I said you have to always be Pro proactive so

in case you are not using any third party actions remove them because this is where we we as a developer are a little bit not um very much active right I mean why should we touch something which works that's what we all do but regularly audit your third party actions see if there are some actions which are not being used just part of the job but never

being used and try to remove them try to upgrade them in case there are some own vulnerabilities on your U the actions which you're using or if there are any better options for example uh I was trying to use action to create a gith up uh to raise a PR and then I found a third party action but thanks to the author who clearly wrote go ahead

and go use gup CLI so of course I was saved but there are so many actions which are not doing that right uh probably they are not uh archiving their repositories so see your options if you can replace them by using something which already exist and gup CLI has so many so many uh commands which can replace most of your use cases or even the GitHub API

right directly calling GitHub API will solve most of your issues but why should we do that I mean it's again matter of your choice whether you want to save time or whether you want to rely on someone who wrote any action which exist be care with be careful with outside collaborators we all learned the lesson again thanks to gatan I don't know who this guy is but

Kims coming in my talk so uh we all uh all of you might have this enabled it's called require approval for first-time collaborators even for your open source projects I would recommend switching it off and going to require approval for all outside collaborators so in case you have any outside collaborator they always have to get approval before they run your action if you trust someone um just

go ahead and add them as a team member right rather than actually keeping them as outside collaborator so you don't have to approve every time but we we all learned our lessons right I mean we have probably burned our fingers more more often uh than we should because you see with all this superpowers comes great responsibility right Spider-Man and that's what is happening you got GitHub actions

now you can write your GitHub actions easily you can have more superpowers but again there is a drawback there are people more people who wants to exploit those and steal your data there are more ways now this is very interesting because one of the most powerful thing in GitHub universe is GitHub token we all know that right and if someone steals your giup token okay then God

Saves you otherwise it's okay uh so follow list privilege uh this is something which we also don't do I mean who who actually follows this list privilege principle anyone wow thank you so you should uh you should do that and I will give you some hints like how you can actually do this uh or how you can actually get the idea like what privilege you should have

so GitHub token is as I said most powerful token in the entire GitHub universe and it has privilege as similar as admin so it can do anything it can delete your repository it can create a new repository create new issues much PS everything so by default you have read and write permission but switch it on to read permission if possible so you can have uh read uh

read repository for contents and package permission by default and then once you need more permission you can actually do this so on your jobs you can actually Define this this is something which you can do on your on jobs basis as well as Global so you don't have to go ahead and just enable all the permission for your GitHub action just keep it at read and then

whenever you read you need more permissions you can just ask GitHub actions to give you more permission with GitHub actions or GitHub tokens sorry so this is how you can do it at Job sorry at workflow level so you can after your event you can s just say permissions and then you can say hey give me read all U uh read all access on this workflow so

I can read everything which I want to basically reading issue reading permission reading PR everything in case you want to do it at Job level this is something you can need for example let's say if you are publishing your packages right on npm so you may have uh you may need packages right and pull request right basically because you will also uh push push the commits right

sver s version so do this follow this principle but again this is hard to identify right which what level of permission I should have so I'll come to that point like how you can do that but again uh when it comes to your secrets uh have environment level secrets so there are less chances that your secrets leak and uh here like I can show you where you

can have okay so all settings exist here so you can go to your settings tab and okay why is so slow okay meanwhile it's opening I can go back to my slide something happened with the internet let's say it's trying to connect okay I'll just disconnect and connect again Works 90% of the time ah okay it worked again so yeah so you can go to your environments

and you can actually have a new environment and configure let's say a new environment for testing and you can add your environment level secrets here so for example if you need a uh let's say secret for publishing or pushing your artifacts on AWS which is only required when you releasing things for example production so you can just add the environment secrets for production not the global one

right or add the repository level or the organization level I mean you should not have secretes at or level until unless you need it but just be careful because we all make mistake right we we are human even Chad jib makes mistake uh now the next topic about around tokens is personal access tokens we all love to create personal access tokens right so we probably you also

have one token which is created right now and never used which is which is okay but uh again there are chances that you may lose your data just in case someone can someone access your personal access token so there are few things which you can do first newly launched it's still in beta it's called new fine grain personal access token uh it's I think you might have

access as well so you can actually rather than using the classic tokens which I can show you how it looks like not my token for sure but uh let's go and you can go to settings and this is where you create tokens so you have this tokens which is and this is Ash right yeah so this is the classic token you can see it never expires because

who wants to create a new token every 90 days but this is not recommended so in case you are still using it of course I will delete it after this talk because otherwise people will ask me I'm giving a talk about best practices and I'm just doing the wrong thing so of course I will move to find Grand tokens which are available now and you can actually

set an expiry okay okay hope no one saw my password yeah so you can see uh now you can actually set the custom expiry so you let's say if you want onetime token which is only for limited time you can do that now so you can let's say set 7even days token and then it gets expired or you can just say custom like of course I want

to like make sure that it expires on this day so this is a good thing uh move all your tokens sorry personal access tokens to uh fine GR uh bat or personal access tokens as soon as you can so still in beta in case you don't have access probably you can enable it by going to feature preview right you all know right how to access preview and

U one more thing about personal access tokens whenever you are creating your personal access tokens make sure like as an org admin you also have S s2f enabled right so people can register it so you don't have to worry about yeah so enabled to F and SSO most important thing to do um and register all your secrets don't throw it around so this is one thing people

don't try to do but make sure like all the secrets are registered so no one can hack it one more thing rotate your tokens again as I said best practices starts but you have to make sure that they remain right you're still following the best practices this is where it comes being proactive you have to make sure your you rot rotate your to tokens do planned audits

probably 90 days or 30 days whatever you set as an or admin and rotate all your tokens now you can use for tokens I think you can use third party Services as well and when it comes to third party Services I haven't of course I haven't added that uh section here but make sure U it's like not everyone have has access to the your third party uh

third party tool right where you are storing your tokens so probably have one single admin who sets a password and probably he only knows the password to access all your tokens so this is a good practice but again you rely on a single person so maybe one or two as I said have fewer admins now when it comes to knowing what level of permission you should have

this is where GitHub GitHub security did a great job they announced it last year during GitHub universe so there is a GitHub security action permission monitor action which can tell you you can actually set it on your job level and it will tell you like what permission this job needs whether it needs read access only whether it needs let's say package write access only so it can

give you all the data it can just like push it as part of your artifact and then you can use that data to actually set the permission or you can say fine grain permission to your jobs so in case uh you're not doing this I think you should you should go ahead and add it so you know like what level of permission you have and what is

the minimum level of permission required for action they also have uh they also have two action basically one is of course action permission and there is another called advisor so advisor advisor action basically is you don't have to add it as your job as as a step of your job but it can give you um yeah it can give you an action where you can throw away

your workflows and run it and see like what level of permission you need basically no one wants to add this to your job until unless you really need it right why should you do that so this is where the advisor action comes really handy as I said like I have so many things but I try to cover only few because I have a I'm going to give

a demo get up code spaces workflow uh sorry sorry co-pilot workspaces and these are some references uh thanks to my friend Joseph from GitHub security team who actually gave it to me I'll share it uh probably U yeah somewhere on maybe Twitter or LinkedIn so you can get all these uh references as well there are a few more things which I want to talk about for example

if you're doing gab actions you know one let's write the faction first and then we see about it so let's go hope uh okay okay so let's see if live demo works or and here so of course this is my own repository and let's see if we can write a GitHub action using GitHub pilot workspaces I've been exper experimenting it a lot recently and giving some uh

feedbacks to the GitHub team as well uh just in case you get access to this feel free to give send um any feedback you have so let's create so is this visible I'll just zoom in a lot okay so let's create uh GitHub build my package the then I'll say okay this package uh build command npm run build and then I want to actually run this on

let's say multiple version of nodejs right run it on 18 and 20 I'll say Okay use what is this jav uh whatever supposed to WR uh use this is one thing which uh still lacks in GitHub copilot workspaces so in case you don't Define that you need latest version of GitHub actions it can throw you the older version so generally it's check out version two and same

for nodejs so just make sure that you define this for for time being use latest actions ready so let's create it oh no it's working so I thought like it's it's broken so uh this is how it works the get up code U copilot work spaces it will start writing the specification for you uh once you define the task so this is the important step right so

defining defining the task correctly and that's why our job is safe so it will write all the specification what is the current state of your workflow like it's it will check if you already have something called build and uh it will propose some solutions so let's see what it is proposing so it says okay GitHub action exists for build and it's uh using npm run build version

18 and 20 so it says okay U this is the proposed solution it says okay configure to run on push to master even though I haven't defined it but it says okay it will configure it and it will use nodejs let's see 18 and 20 then it will generate a plan great so I'll say Okay implement the selected so now it is implementing so U basically it's

very useful in case you want to do some poc's where you want to set up some initial task and then start uh revising your actions so of course don't copy paste the same thing which is shown here right so make sure that you go through what is actually written in your workflow and then accept it so it says update the build command in the command to match

the specified so it also adds the documentation which is says even you GI up co- pilot workspaces do like documentation PR for you for example if you want to change some small documentation you don't have to do it manually just just Define a task I've been doing it to save some time yeah and of course it takes a little bit of time but I hope it writes

this right action for us so line number 255 I think ah we have 15 minutes so okay I think 15 minutes is more than enough to finish task and one more important thing it can understand your context so in this case you know I already have a build TK and I have already defined it to run on JS 18 and 20 so it's just saying okay probably

what didn't match is the build command so it's just updating the build command so this is what I wanted to show it's not like a dumb AI but it also understands your context so if it's something which already exist it will not going it will not write the same action again for you so of course just to make a document documentation change this is too much time

but still like you don't have to worry about knowing the context of your code base right so you can just create the task and see if it exists it does that automatically for you uh language in the uh I mean for example you want to run for net or something else like that ah okay yeah you can I think it supports most most of the languages so

let's define something which doesn't exist so let's say as I said like the build task already exists so that's why just updating the command and nothing else but let's create a new workflow right actions to get actions to no yeah almost I mean just to make a single line command change or commment change let's see uh what I can do create a GitHub actions to deploy I

already have a deploy H this is something which is really cool example close stale Pi so let's say I want a task to delete my stale branches right and it should delete branches more than 100 days and I would say run Friday 12: p.m. CD and let's see so I just changed my specification let's see what it does so it actually cancelled the previous task now which

is nice of course and I'll say okay this is save and I have to yeah we'll start generating the specification again and let's see it will it should actually say okay is it's trying to see if there is any action which exist it says no there is no ex existing action so what we it needs to do now it will propose the solution so it will propose

that yes a gab action is now configured so I'll say okay I'll say update the plan and update it now it should create a workflow file well okay so it says a delete still Branch workflow is created now I can say Implement selected now you'll see it of course generates the documentation but it also generates or just writes the entire workflow for me so really good in

case you want to do some quick PC and you want to do some task which is probably critical uh but should not be uh given too much time so here so it says there is a custom action even it can read the internet okay what I did let me go back mhm yeah it it actually knows where to go so it's okay but you know uh it

can also read all the marketplace and see if there is an custom action which exist and it just use something called Dev Dr Prasad and he has already written a custom action to automate this task and it will just use that task again be careful as I said don't copy paste it blindly because this action might be archived this is something which is in feedback so I

just gave them a feed back that it is still using the actions which are archived so probably they will revise it and drop a new model which can do smart thing not uh using the actions which are already archived and then you can say okay if something everything looks good go ahead and create a PR and it writes the most important thing which is description right I

know I'm really bad at writing description so at least it does better job than me and then you can create a poll request this is your poll request now your reporting manager is happy because it has a nice description as well and you just did something rather than wasting probably for me it's like 10 15 minutes job looking for some action and then using it but you

can just start this task and go have your coffee and come back and it's already WR for you and this is right I mean this was my de demo so we saw both the use cases where it it is context aware that if something exists don't TR write it but if something doesn't exist it will create it for you and as I said these are some references

I'll try to share it on LinkedIn or Twitter and thanks again to my giup sponsors that's they are the reason I'm here so commentar Ro one of my GitHub uh biggest GitHub sponsor Sunil dashan umir Anand just in case you are watching thanks again for all the support you gave me and thank you thank you so much for your time yeah I think we have time so

you can take questions if thank you Santos uh do you have any questions from the hall we can bring you microphone yep uh you talked a little bit about environment uh secrets and configuration um can you elaborate a little bit uh how it can be used to protect uh organization level secrets because if you like have a organization level secret right uh and it's enabled for all

repositories even you want to enable them on newly created repositor how do you protect the secrets yeah so this is so it can be yeah so this is a good u i mean get up see or level secrets are always critical right because they have much more access basically it's called GitHub uncore token which is enabled by default for Ur now don't try to create uh as

I said like try to create environment level secrets which you can do as per environment don't try to have let's say if you want to access S3 bucket right and you want to make sure it's available on all the most of the projects try to add them there so it's not leaked in case your uh main organization is compromised so you can actually just access it in

the job or there's less chances of being compromised because you don't have it available globally but good way is to actually use third party providers where you can store secrets for example some for example Azure ID right so you can actually just save your secrets on Azure ID and then access it U again that's very uh U the point of failure is less because of course that's

where that's something where in on your Cloud so you are safe just in just in case you're trying to access those Secrets but it all comes down to your jobs like what you are writing in your jobs right there are chances that you just write some wrong iTab action and then you expose your uh your tokens in basically when whenever you try to uh use secrets you

either you is from environment variables and don't try to use it in your scripts for example if you're running some scripts don't try to access them directly because once you run it in debug mode they are actually printed as it is so it's visible so try to use environment uh EnV I know there is there is a property called EnV you can just set it to EnV

first and then access it so it masked it mased automatically you don't have to show it so yeah and next to you a great GI up expert is setting Michael so if you have more question you can always ask Michael he'll be around here so he recently wrote a book just in case someone wants to get in touch with him yeah yep anybody else have any questions

uh in the hall just raise your hand then we bring your microphone or we can we can go to the slideer so first question can GitHub action use different environment Secrets AKA one job deploy to different Ms one job I think that's possible right that's what that's why environments are so can get up action different Secrets I think yeah for sure okay so I still not sure

what the question was but basically okay he's trying to use same GitHub to sorry same uh in a same job environment level tokens for different environments I don't think so that's possible because that's why they are called environment level tokens so you have to use in that specific environment for example staging or production or you can uh def Define it in a single workflow and you have

different environments defined basically then you need to approve it multiple times basically once it goes through let's say we do that for example creating a release branch and then publishing a release there are two tasks but we try to do it in the same workflow so you get like mail notification twice those just one second we can't see slide slide yeah now we can see so this

question what are the tokens stored okay where are the file name I mean generally you define your tokens here so you can say environments and then you can create new uh environment here or you can just actually go to actions and sorry secrets and variables so you can go to secrets and variables and create your environments sorry your secrets and if you want to save them on

third party solution I mean that's up to you you are using Azure ID so use uh the Azure ID or if you want to use different for example one password use you can use one password to do that but in that case they might have a GitHub app which you may have to add into your GitHub organization to access those tokens okay GitHub has a user based

pricing model is there any difference between team members and outside collaborators in that regard okay so I don't work for GitHub but I don't think so I mean to to get started with I mean I think GitHub Enterprise is not free but you can still use the teams on your free version as well I think that's possible but for Enterprise I have no idea I mean uh

you you may need to ask sorry is okay so they need one license so yeah if we have 30 repos in organization how can I see overview of all GitHub actions or at least scheduled ones with Chron without going into each rep a good question because uh GitHub actually recently launched feature I mean I don't have access to it because I'm not or level but they launched

something in insights if I'm not wrong so you can go to your insights and apart from depend bot there should be another uh another option available still in public beta U I'm not sure if your organization may have access it's uh something which was recently launched so you can see all the actions it will also show you like how much money you are paying for those actions

and how much time it is taking uh to run those actions everything is available the only thing is I don't have access to it so you you may need to check with your your or admin and if you don't have access reach out to me probably I can ask someone from GitHub access and uh we have few minutes left so the last question GitHub has a user

based price we took care of it it's the same okay sorry uh any recommendation how to manage and clean self-manage GitHub Runners that's difficult right I mean we also struggle with this in case I mean I'm going to ask Michael how what he recommends but use maintenance containers oh okay so as per Michael use a containers so uh you basically you can remove the containers once they

are not needed U we we are also experimenting with something called anx uh which has anx agents which can do this automatically for you in case you are running I mean anx is a cloud-based provider so to run your workflows and to speed up your bills if you are on angular or any technology I think they support most of the technology but you can also try anx

sence they do it you yeah I think it's now that's all for now and we are run out of time uh thank you Santos very much Applause for Santos