Security and Permissions

This section introduces the security mechanisms of AtomGit Action, including Secrets management, Token permission control, and security best practices for PR/MR pipelines.

📄️ Managing Sensitive Information with Secrets

Applicable Scenarios: When a pipeline needs to use sensitive information such as passwords, API keys, or access credentials, but you don't want to hardcode them into workflow files or code repositories.

📄️ Token Permissions and Least Privilege

Applicable Scenarios: The default token (ATOMGIT_TOKEN) for pipelines has repository-level read and write permissions. However, under the principle of least privilege, the token should be restricted to only the minimum permissions required by the job to prevent privilege escalation.

📄️ PR/MR Pipeline Security

Applicable Scenarios: The Pull Request (PR) pipeline needs to execute code from external contributors (fork repositories), which poses a security risk. It is necessary to understand the security differences between the pullrequest and pullrequest_target trigger events, and choose the appropriate configuration.