Q:

GitHub Actions: Are there security concerns using an external action in a workflow job?

I have a workflow that FTPs files by using an external action from someuser:
    - name: ftp deploy
      uses: someuser/ftp-action@master
      with:
        config: ${{ secrets.FTP_CONFIG }}

Is this a security concern? For example could someuser change ftp-action@master to access my secrets.FTP_CONFIG? Should I copy/paste their action into my workflow instead?

A:

If you use ftp-action@master then every time your workflow runs it will fetch the master branch of the action and build it. So yes, I believe it would be possible for the owner to change the code to capture secrets and send them to an external server under their control.
What you can do to avoid this is use a specific version of the action and review their code. You can use a commit hash to refer to the exact version you want, such as ftp-action@efa82c9e876708f2fedf821563680e2058330de3. You could use a tag if it has release tags. e.g. ftp-action@v1.0.0
Although, this is maybe not as secure because tags can be changed.
Alternatively, and probably the most secure, is to fork the action repository and reference your own copy of it. my-fork/ftp-action@master.

