Guide urges pinning GitHub Actions to commit SHAs to block supply chain attacks
RESEARCHGitHub Actionsredteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
The article is part one of a series on hardening GitHub Actions against outside attackers. It explains that version tags such as @v4 are movable pointers, and cites the March 2025 tj-actions/changed-files compromise, where repointed tags exposed credentials in public build logs. It recommends pinning actions to full 40-character commit SHAs, enforcing this with zizmor and an organisation policy, and warns that a SHA proves immutability but not provenance.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Pin every GitHub Action to its full 40-character commit SHA rather than a version tag or branch.
- Enforce SHA pinning through an organisation Actions policy and run zizmor in CI.
- Check whether any workflows referenced tj-actions/changed-files or trivy-action by tag, and review their build logs.
- Verify that pinned commits belong to the action's own repository before approving pull requests that change them.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Socket Blog
Who and what is in it
Threat actors
Products