Guide urges pinning GitHub Actions to commit SHAs to block supply chain attacks
RESEARCHGitHub Actionsredteam/daily · 1 source
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
Attackers have been hiding malicious code inside trusted software packages, often during the automated release process that runs on GitHub Actions. This article explains how to make that automation harder to abuse, starting with not trusting version labels that can be quietly changed.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Pin every GitHub Action to its full 40-character commit SHA rather than a version tag or branch.
- Enforce SHA pinning through an organisation Actions policy and run zizmor in CI.
- Check whether any workflows referenced tj-actions/changed-files or trivy-action by tag, and review their build logs.
- Verify that pinned commits belong to the action's own repository before approving pull requests that change them.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Socket Blog
Who and what is in it
Threat actors
Products