GitHub Actions 安全与 Secret 管理：权限控制、OIDC 认证、审计与最佳实践

# ❌ 危险：默认赋予所有权限
# （不设置 permissions 时，默认读写所有内容）

# ✅ 推荐：显式声明最小权限
permissions:
  contents: read           # 只读代码
  pull-requests: write     # 仅 PR 操作
  id-token: write          # OIDC Token（云认证）

jobs:
  deploy:
    permissions:
      contents: read
      packages: write      # 推送容器镜像
      id-token: write

# 在组织级别限制默认权限
# GitHub Organization → Settings → Actions → General
# Default workflow permissions: Read repository contents and packages permissions

# ✅ 正确：env 注入，避免命令行回显
jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      API_KEY: ${{ secrets.API_KEY }}
    steps:
      - run: |
          curl -H "Authorization: Bearer $API_KEY" https://api.example.com

# ❌ 危险：直接在命令行使用（部分 CI 系统会回显）
# - run: curl -H "Authorization: Bearer ${{ secrets.API_KEY }}" ...

permissions:
  id-token: write
  contents: read

jobs:
  deploy-aws:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
          aws-region: us-east-1
          role-duration-seconds: 1200  # 临时凭证有效期

      - run: aws s3 sync ./dist s3://my-bucket

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Federated": "arn:aws:iam::123456789:oidc-provider/token.actions.githubusercontent.com" },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" },
      "StringLike": { "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:*" }
    }
  }]
}

- name: Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: GCP Auth
  uses: google-github-actions/auth@v2
  with:
    workload_identity_provider: 'projects/123/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
    service_account: 'github-actions@my-project.iam.gserviceaccount.com'

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    reviewers:
      - "octocat"

name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
  schedule: [ cron: '0 9 * * 1' ]

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript, typescript
      - uses: github/codeql-action/analyze@v3

- run: npm audit --audit-level=moderate
- run: npm audit fix --dry-run  # 查看建议修复

- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
  with:
    base64-subjects: "${{ hashFiles('dist/**') }}"

- name: Sign artifact with Sigstore
  uses: sigstore/cosign-installer@v3
- run: |
    cosign sign-blob --yes dist/app.tar.gz \
      --output-signature dist/app.tar.gz.sig \
      --output-certificate dist/app.tar.gz.crt

cosign verify-blob --signature app.tar.gz.sig \
  --certificate app.tar.gz.crt \
  --certificate-identity-regexp="^https://github.com/my-org/my-repo/.github/workflows/.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  app.tar.gz

jobs:
  deploy-production:
    runs-on: [self-hosted, production]  # 标签限制

name: Audit Log Monitor
on:
  workflow_run:
    workflows: ["*"]
    types: [completed]

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      actions: read
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const run = context.payload.workflow_run;
            if (run.conclusion === "failure" && run.run_attempt > 3) {
              // 多次重试失败，可能存在攻击或配置篡改
              console.log("::warning:: 工作流多次失败后完成，请审查");
            }
            // 记录运行时长异常（正常 5min，突然 30min）
            const duration = (new Date(run.updated_at) - new Date(run.run_started_at)) / 60000;
            if (duration > 30) {
              console.log(`::warning:: 工作流运行异常耗时 ${duration.toFixed(1)} 分钟`);
            }

curl -H "Authorization: token $TOKEN" \
  "https://api.github.com/orgs/my-org/audit-log?phrase=action:secret_scanning&per_page=100"

jobs:
  deploy-production:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://app.mycompany.com
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh production