- Keep your Actions minimal
- Don’t install dependencies unnecessarily
- Never hardcode secrets
- Limit environment variables to the narrowest possible scope
- Ensure every repository contains a CI/CD workflow
- Store authors in Action metadata to promote code ownership
- Don’t use self-hosted runners in a public repository
- Forwarding a Docker socket to Jenkins container to avoid a 'docker-in-docker' situation