GitHub · GH-200
OIDC, pinning, policies, and attestations
GH-200 · Lesson 15 of 16 · 2:20:26
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-200 exam (GitHub Actions). In this lesson: OpenID Connect for cloud federation without stored secrets, subject and audience claims with immutable subject formats, pinning third-party actions and enforcing action policies, and artifact attestations with actions/attest, SBOMs, SLSA build levels, and gh attestation verify before deployment. Includes three original practice questions.
Preview the topics
- Contoso’s deploy job uses Azure login with OIDC, but fails because it cannot get an OIDC token. The workflow sets its permissions to contents: read only. What’s missing?
- Contoso’s workflows reference a popular third-party action by its v3 tag, and the security team wants protection if its maintainer’s account is compromised and the tag is repointed. What should they do, at minimum?
- Contoso’s production deployment must only accept installers built by the platform team’s reusable build workflow. Which check fits in the deploy job?