AZ400-Q: reduce third-party action risk
A workflow uses a third-party action with broad repository permissions. The maintainer wants to reduce supply-chain risk. Which improvement is strongest?
- A) Pin/review the action version or immutable reference, grant minimum workflow permissions, and monitor/update it through the normal dependency process. ✓
- B) Use
permissions: write-allfor convenience. - C) Copy the action’s code into a comment.
- D) Disable pull-request checks.
Answer: A. Actions are code dependencies. Pinning/review, least privilege, and maintenance reduce uncontrolled change and blast radius.
Why not the others: Broad permissions and disabled checks increase risk; comments do not execute or secure the dependency.
Related
pipeline-security · github-advanced-security · dependency-and-supply-chain