If you discover a security vulnerability in this project, please open a private GitHub Security Advisory:
- Go to the Security tab
- Click Report a vulnerability
- Describe the issue and include steps to reproduce
Do not open a public issue for security vulnerabilities.
This action is designed around the principle that no long-lived credential ever touches the pipeline.
| Mechanism | How it works |
|---|---|
| Authentication | GitHub OIDC JWT — GitHub's identity is the credential, no API key stored anywhere |
| Authorization | Conjur policy enforces least privilege — each host can only access explicitly permitted secrets |
| Secret delivery | Secrets are masked before being written to GITHUB_ENV — values never appear in logs |
| Transport | All communication with Conjur is over HTTPS |
| Rotation | Credentials rotate in Privilege Cloud without any pipeline changes |
- No passwords or API keys in the repository
- No credentials in GitHub Secrets (only Conjur URL and service ID)
- No secrets written to disk — only injected as in-memory environment variables
This action runs a Docker container on a self-hosted runner. The container runs as root to write to GITHUB_ENV. Ensure:
- The self-hosted runner host is hardened and access-controlled
- The runner only serves trusted repositories
- Docker daemon access is restricted to the runner user
For production use, apply the following to the Conjur policy:
- Use
enforced-claimswith at leastrepositoryandworkflowto bind the JWT to a specific pipeline - Scope the host's variable permissions to only the secrets it needs
- Do not grant
!group appsaccess to the JWT authenticator for all workflows — create per-workflow hosts
This repository uses Trivy for container vulnerability scanning (see .trivyignore for known accepted findings). Run locally with:
trivy image --exit-code 1 workshop-action:latest