Attest GitHub Actions build artifacts and verify before deployment
An artifact attestation binds subject identity and digest to signed provenance generated by a workflow; deployment must still verify the expected repository and policy.
Prevent overlapping GitHub Actions deployments with one environment key
A concurrency group allows one running and one pending job or workflow per key; cancel-in-progress determines whether a newer run interrupts active work.
Design a GitHub Actions rollback job that does not rebuild history
A rollback should select a previously verified immutable artifact, pass the same environment gate, deploy through the same mechanism, and record a new deployment event.
Use GitHub Actions environment approval as a real deployment boundary
An environment can gate jobs with reviewers, branch rules, and protection rules; environment secrets are withheld until configured protection passes.
Manage SSH known_hosts in GitHub Actions without trusting the scan itself
Ssh-keyscan retrieves offered host keys without authenticating them, so CI must compare a pinned fingerprint delivered through an independent trust path.
Replace long-lived GitHub Actions cloud keys with constrained OIDC
A job with id-token write can request a short-lived signed token whose claims the cloud provider maps to a narrowly scoped role.
Build a reusable GitHub Actions deployment workflow with a narrow contract
Workflow_call defines typed inputs, secrets, permissions, and outputs so repositories can reuse reviewed deployment logic without copying mutable shell blocks.
Mask GitHub Actions secrets without treating redaction as containment
GitHub masks registered secret values in logs, but transformed, encoded, structured, or dynamically fetched values may need explicit masking and should not be printed at all.
Harden GitHub Actions self-hosted runners as disposable execution hosts
Self-hosted jobs execute on infrastructure you control and may persist processes, files, credentials, and network reachability unless each job receives an isolated ephemeral environment.
Build a GitHub Actions SSH deployment with a narrow remote command
An SSH deployment job should deliver an immutable artifact and invoke a reviewed least-privilege remote entrypoint rather than streaming arbitrary repository shell into production.