Skip to content

Add recommendations for runner groups and labels - #91

Open
konstruktoid wants to merge 16 commits into
github:mainfrom
konstruktoid:rungroup
Open

Add recommendations for runner groups and labels#91
konstruktoid wants to merge 16 commits into
github:mainfrom
konstruktoid:rungroup

Conversation

@konstruktoid

@konstruktoid konstruktoid commented May 22, 2026 •
edited
Loading

Copy link
Copy Markdown

This pull request makes several improvements to the documentation on securing GitHub Actions workflows. The most significant updates include adding new recommendations for segregating runners, enhancing repository ruleset guidance, and updating author attribution.

Enhancements to security recommendations:

  • Added a new recommendation to segregate runners by using organizational runner groups and labels to separate high-privilege from low-privilege runners, reducing the risk of unauthorized access to sensitive resources. [1] [2]
  • Expanded repository ruleset guidance by recommending the use of "Require workflows to pass before merging" to enforce organizational or enterprise-level workflow requirements prior to merging.

Documentation and metadata updates:

  • Updated the authors list in the document metadata to include Thomas Sjögren (konstruktoid).

@konstruktoid
Add recommendation regarding runner groups and labels
c8a8f40 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 22, 2026 16:03
@konstruktoid
konstruktoid requested review from a team as code owners May 22, 2026 16:03
Copilot AI reviewed May 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the “Securing GitHub Actions Workflows” guidance by adding runner-segregation recommendations and expanding ruleset guidance, while marking the page as draft.

Changes:

  • Set the page to draft: true and added an additional author.
  • Added “Segregate runners” as a top-level recommendation and a dedicated section with implementation details.
  • Added a repository ruleset recommendation to require workflows to pass before merging.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
@konstruktoid
adjust to documentation terminology
b974622 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@konstruktoid
split into shorter sentences
72c1fa7 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Copilot AI mentioned this pull request May 27, 2026
Closed
@konstruktoid
set draft: false
d0109d7 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
tspascoal
tspascoal reviewed May 27, 2026
View reviewed changes
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security.md
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
@konstruktoid
replace and with or
2a3e165 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
kenmuse
kenmuse reviewed May 27, 2026
View reviewed changes
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
Comment thread content/library/application-security/recommendations/actions-security/index.md Outdated
konstruktoid and others added 5 commits May 27, 2026 16:29
@konstruktoid @kenmuse
Update content/library/application-security/recommendations/actions-s…
114a9e6 
…ecurity/index.md

Co-authored-by: Ken Muse <kenmuse@users.noreply.github.com>
@konstruktoid
rewording regarding secrets
1c1845d 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@konstruktoid
reword secret access
ed08520 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@konstruktoid
just mention sensitive resources
7df4b2b 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@konstruktoid
Merge branch 'main' into rungroup
41456dd
@konstruktoid
konstruktoid requested a review from Copilot June 16, 2026 14:42
Copilot AI reviewed Jun 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comment thread content/library/application-security/recommendations/actions-security.md
well-architected-sync-bot Bot and others added 2 commits June 18, 2026 07:21
@well-architected-sync-bot @dkalmin @konstruktoid
Sync from inner source [auto] (github#108)
2e8b069 
* Sync from github/github-well-architected-internal (main)

Source Repository: github/github-well-architected-internal

Source Branch: main

Source SHA: 19df7eb80cb63be9f9f42048ccf315e876108117

* Fix PR HTML proofer by preprocessing content

---------

Co-authored-by: well-architected-sync-bot[bot] <235114805+well-architected-sync-bot[bot]@users.noreply.github.com>
Co-authored-by: David Kalmin <dkalmin@github.com>
@well-architected-sync-bot @konstruktoid
chore(repo): sync from inner source
1a338a1 
Sync from github/github-well-architected-internal (main)

Source Repository: github/github-well-architected-internal

Source Branch: main

Source SHA: ff52156188feebe7b601a566b5112519172b4714

Co-authored-by: well-architected-sync-bot[bot] <235114805+well-architected-sync-bot[bot]@users.noreply.github.com>
@konstruktoid
Merge branch 'main' into rungroup
dfc235f
@konstruktoid
clean up after failed web commit
7d7d25f 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@konstruktoid
add bypass requests link and more web commit cleanup
5a3bfef 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
@github-actions

github-actions Bot commented Jul 17, 2026

Copy link
Copy Markdown

Thanks for raising this PR! To keep the project healthy, we close inactive PRs after some time. There has not been any activity in the last 28 days - if you are still working on this or feel it should remain open, just leave a quick comment in the next 7 days to let us know where things are at. We really appreciate your input!

@github-actions github-actions Bot added the stale Stale object label Jul 17, 2026
@konstruktoid
konstruktoid requested a review from Copilot July 17, 2026 09:30
Copilot AI reviewed Jul 17, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@konstruktoid

konstruktoid commented Jul 17, 2026

Copy link
Copy Markdown
Author

any descision regarding this?

@github-actions github-actions Bot removed the stale Stale object label Jul 18, 2026
@github-actions

github-actions Bot commented Aug 16, 2026

Copy link
Copy Markdown

Thanks for raising this PR! To keep the project healthy, we close inactive PRs after some time. There has not been any activity in the last 28 days - if you are still working on this or feel it should remain open, just leave a quick comment in the next 7 days to let us know where things are at. We really appreciate your input!

@github-actions github-actions Bot added the stale Stale object label Aug 16, 2026
@konstruktoid

konstruktoid commented Aug 16, 2026

Copy link
Copy Markdown
Author

OWASP/CheatSheetSeries#2236

@github-actions github-actions Bot removed the stale Stale object label Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kenmuse kenmuse kenmuse left review comments
@tspascoal tspascoal tspascoal left review comments
Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@bot-digital-customer-success bot-digital-customer-success Awaiting requested review from bot-digital-customer-success

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@konstruktoid @kenmuse @tspascoal