How to Build a Secure GitHub Actions CI/CD Pipeline for Azure

Secure GitHub Actions deployments to Azure by treating CI/CD as privileged production infrastructure.

Pipeline

PR -> Security Checks -> Build/Test -> IaC Scan -> Container Scan -> Plan -> Approval -> Production

Controls

• Use OIDC workload identity rather than long-lived Azure secrets where supported.
• Restrict GitHub token permissions.
• Protect production environments.
• Separate development, staging, and production identities.
• Run CodeQL/Semgrep, dependency, Gitleaks, IaC, and container scans.
• Monitor workflow and environment changes.

Example:

permissions:
  contents: read
  id-token: write

Production Protection

Use environment approvals and narrowly scoped deployment identities.

Monitor

Watch workflow YAML changes, Actions permissions, deployment identities, secrets configuration, and unexpected workflow execution.

Final Takeaway

The CI/CD pipeline itself is part of the attack surface. Secure its identity, permissions, artifacts, workflows, and deployment path.