Production checklist
GitHub production checklist: 5 checks before launch
5 checks for running GitHub in production: 4 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (4)
Turn on secret scanning push protection
Blocks commits that contain API keys before they land in history.
How to verify
In the repository’s settings under Advanced Security (Code security on older plans), secret scanning and push protection are both enabled.
Least-privilege GITHUB_TOKEN and pinned actions in CI
A compromised third-party action runs with your token and secrets.
Verify from the command line
Workflows set permissions: contents: read at the top, and third-party actions are pinned to a full commit SHA. This lists uses: lines that aren’t pinned (your own ./ actions are fine).
grep -rn "uses:" .github/workflows | grep -vE "@[0-9a-f]{40}"Require two-factor authentication for the organization
One phished password otherwise gives push access to your code and CI secrets.
How to verify
Organization settings → Authentication security: Require two-factor authentication is ticked.
Turn on Dependabot alerts and security updates
You hear about vulnerable dependencies the day an advisory is published, with a fix PR.
Verify from the command line
A 204 response means Dependabot alerts are on; 404 means they’re off. Turn on security updates in the same settings page.
gh api -i repos/<owner>/<repo>/vulnerability-alerts
Good to have (1)
Protect the main branch (reviews + required checks)
Nothing reaches production without passing CI.
Verify from the command line
The main branch should require reviews and status checks. A 404 "Branch not protected" means it isn’t, unless a ruleset covers it.
gh api repos/<owner>/<repo>/branches/main/protection gh api repos/<owner>/<repo>/rulesets
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.