6.3. Reflection Checkpoint

Key Takeaways

• GITHUB_TOKEN is an ephemeral, repository-scoped installation token — shrink it with permissions: rather than replacing it with a PAT. 403 "not accessible by integration" is always a permissions fix. Events triggered by GITHUB_TOKEN do not start new runs.
• Script injection works because ${{ }} is substituted before the shell parses the script; quoting does not help. Route untrusted values through env: and reference them as $VAR. Treat pull_request_target + checkout of PR head as a critical vulnerability.
• OIDC removes stored cloud credentials entirely: permissions: id-token: write, a cloud trust policy constrained on sub claims (repo + ref or environment), short-lived credentials in return.
• Supply chain defense layers: org policy decides what may run, full-SHA pinning (or an immutable published version) decides which bytes run, permissions: decides what it can do, environments decide whether a human agreed, and attestations prove what was produced and how.
• Environments gate secrets and deployments — required reviewers, wait timers, branch policies — but they do not protect the workflow file; branch protection and CODEOWNERS do.
• Optimize in order: eliminate runs (path filters, if:, concurrency + cancel-in-progress for PRs only), parallelize (job splitting, matrix sharding, max-parallel), then accelerate (caching, runner sizing, timeout-minutes, prebuilt images).
• Caches are free, capped at 10 GB per repository, LRU-evicted, and removed after 7 idle days; artifacts are billed with a 90-day default retention that almost always should be shortened.

Connecting Forward

That completes the five exam domains. Phase 7 turns the material into exam performance — timing strategy, a condensed quick-reference of the facts most likely to be tested, and mixed practice questions in the exam's own style. Phase 8 is the glossary, and Phase 9 closes with a confidence checklist you can use to decide when you're ready to book.

Self-Check Questions

• A workflow needs to publish a package, request an OIDC token, and check out code. Write the permissions: block, and explain what breaks if you list only the first two.
• Given run: echo "Branch: ${{ github.head_ref }}", explain precisely why this is exploitable and rewrite it safely — then name the org-level control that limits the damage if someone ships the vulnerable version anyway.
• Your Actions bill is dominated by one repository's PR runs. List the three optimization moves in the order you'd apply them, and name the one that would be actively harmful if copied to the production deploy workflow.