Tutorial on good practices for GitHub actions (Continuous integration)

I recently was warned about a security issue with one of the actions I used (tj-actions/changed-files). The action got hacked and could potentially retrieve tokens from actions logs.

I learned a few lessons from this which are good to share in a tutorial:

• avoid use of PAT (personal access tokens): GitHub now has short-lived permissions settings which can be used instead
• always use minimal required permissions (i.e. do not give write access if not needed)
• only use external actions from trusted sources (possibly a task for IT to set organisation level allowed/not-allowed actions)
• pinning an action by its version tag is not guaranteed to be safe: a hacker could point it to a different commit; to be safe, pin an action by the full SHA of the commit you want to use

Please leave comments in this thread if you know of other good practices.

Start by reviewing the existing tutorials in the repository and current GitHub Actions security guidance. Use the issue's four listed practices as the initial scope, verify them against authoritative sources, and consider the comment thread for additional practices; done means a clear, accurate tutorial covering the agreed guidance.