将凭据存储在 github secrets 中是否安全？

Question

Github Secrets提供了一种将凭据传递给 Github 操作的方法，但是它们是否足够安全以使用高度敏感的凭据来信任？

Answer 1

I'm not sure that anyone can really answer that for you. I think it depends how sensitive, and what level of risk you can afford to take.

What I would suggest, if you are concerned about the security of your secrets, is not to use third party GitHub actions directly. Always fork the action and use your fork in workflows. This will prevent the possibility of someone modifying an action you are using to capture secrets and send them to some external server under their control.

Answer 2

Secrets are encrypted environment variables that you create in an organization, repository, or repository environment. The secrets that you create are available to use in GitHub Actions workflows. GitHub uses a libsodium sealed box to help ensure that secrets are encrypted before they reach GitHub and remain encrypted until you use them in a workflow. For more details see https://docs.github.com/en/actions/security-guides/encrypted-secrets

Add an additional layer of protection by adding org-level access policy and enable reviewer to control env secrets.