Recommended github practices, curated actions, share your experiences from security perspective.

[rzr]

Hi,

I believe it would be helpful to share feedback on GH actions from security perspective.

How do you sign releases' assets ? Should it be done manually ?

softprops/action-gh-release#580

[mbarbero]

Released assets should be signed automatically. I recommend reviewing GitHub documentation about establishing provenance for builds, which explains how to implement digital signatures for your assets and ensure provenance attestation.