2026-10-05T21:32:38Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:27983 2026-10-05T06:44:02Z ddc:004 open_access

Evaluating CI/CD Security Best Practices in the GitHub Actions Documentation Boschanski, Lukas Vieira, Marco CI/CD security Software documentation Security best practices Background. GitHub Actions, the most widely used Continuous Integration and Continuous Deployment (CI/CD) platform, is frequently involved in large-scale software supply chain attacks. While prior work has focused on detecting vulnerable CI/CD pipelines, research has rarely considered preventive perspectives such as analyzing Security Best Practices (SBPs) in CI/CD documentation. Aims. We investigate the completeness of the official GitHub Actions documentation from a security perspective and identify potential improvements to documenting secure CI/CD practices. Method. We employ an Large Language Model (LLM)-based documentation mining pipeline to extract security advice items verbatim. We derive actionable CI/CD SBPs from the OWASP Top 10 CI/CD Security Risks framework and conduct a qualitative analysis by mapping the extracted advice items against these best practices to assess which best practices are explicitly covered. Results. Across 639 documentation pages, we identify 459 security-related advice items, of which 288 are actionable, but only 50% of them map to actionable SBPs. These items primarily address insecure configurations and insufficient credential hygiene. Furthermore, only half of all security advice visual alerts have an adequate warning type. Conclusions. The GitHub Actions documentation lacks a consistent methodology for incorporating SBPs. Moreover, coverage of established CI/CD security best practices is uneven across OWASP risk categories, with several categories receiving little to no actionable guidance. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Lukas Boschanski and Marco Vieira 2026 Is Part Of LIPIcs, Volume 394, 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ESEM.2026.15 urn:nbn:de:0030-drops-279830 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ESEM.2026.15 eng https://creativecommons.org/licenses/by/4.0/legalcode