Guide urges pinning GitHub Actions to commit SHAs to block supply chain attacks
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
The post covers outside-threat controls for GitHub Actions after 2025-2026 supply chain attacks, including tj-actions/changed-files (CVE-2025-30066, March 2025, tags v1 through v45.0.7 repointed to a malicious commit, about 23,000 repositories referencing it) and trivy-action (March 2026, 75 of 76 version tags force-pushed by TeamPCP). Pin actions to full 40-character commit SHAs, enforce this through an organisation Actions policy and zizmor's unpinned-uses rule, and note that pinning silences Dependabot security alerts for actions not using semantic versioning. Verify that pinned commits belong to the upstream repository, since impostor commits reachable via forks can run; zizmor's online audit needs a token.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Pin every GitHub Action to its full 40-character commit SHA rather than a version tag or branch.
- Enforce SHA pinning through an organisation Actions policy and run zizmor in CI.
- Check whether any workflows referenced tj-actions/changed-files or trivy-action by tag, and review their build logs.
- Verify that pinned commits belong to the action's own repository before approving pull requests that change them.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Who and what is in it
Threat actors
Products