HardcodedContainerCredentials.md

Overview

Hardcoding credentials (passwords) in GitHub Actions workflow container or services configurations embeds secrets directly in the repository source code. Anyone with read access to the repository can see these credentials.

Recommendation

Use encrypted secrets instead of hardcoded credentials.

Example

Incorrect Usage

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: registry.example.com/app
      credentials:
        username: user
        password: hackme
    steps:
      - run: echo 'hello'

Correct Usage

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      image: registry.example.com/app
      credentials:
        username: ${{ secrets.REGISTRY_USERNAME }}
        password: ${{ secrets.REGISTRY_PASSWORD }}
    steps:
      - run: echo 'hello'

References

• GitHub Docs: Using encrypted secrets in a workflow.
• Zizmor: hardcoded-container-credentials.