Software Engineering
Study reveals widespread gaps in GitHub Actions workflow security and best practices
Researchers analyzing real-world CI/CD workflows find that developers rarely follow recommended guidelines for permissions, SHA pinning, and configuration standards.
A new empirical study of GitHub Actions (GHA) workflows across thousands of repositories exposes significant compliance gaps between how developers actually structure their continuous integration pipelines and what security and best-practice guidelines recommend.
What the research examined#
Investigators analyzed the structure, complexity, and adherence to best practices in GHA workflows across Java, Python, and C++ projects. Their findings paint a picture of workflows that are relatively simple but poorly standardized and frequently miss critical security measures. The study represents the first large-scale empirical baseline for understanding how open-source projects actually use GitHub's increasingly popular CI platform.
Key findings on workflow design#
The workflows studied tend to be small and heavily reliant on external reusable actions from the ecosystem. While 39.5% of workflows share a common pipeline prefix—suggesting some convergence on initial steps—the overall sequences are highly heterogeneous. Only a single workflow pattern exceeds the 5% frequency threshold globally, indicating that developers are inventing their own pipeline structures rather than following established templates.
Patterns also differ by language: Java repositories show the lowest explicit test adoption rates, Python workflows typically follow more canonical structures but apply weaker security measures, and C++ projects tend toward larger and more structurally diverse configurations.
Security and compliance shortcomings#
Critical compliance failures are widespread across the sampled workflows:
- Permissions management: Many workflows fail to properly configure least-privilege access controls
- SHA pinning: Dependencies are rarely locked to specific commit hashes
- Timeout configuration: Safeguards against runaway processes are frequently absent
- Reusable workflows: Modular workflow patterns remain exceptionally rare
The researchers note that many workflows exhibit build-without-test patterns, suggesting that infrastructure decisions are driven more by ecosystem conventions and GitHub's default settings than by deliberate adherence to security best practices.