There are two primary threat vectors via GitHub actions:
- GitHub Action YAML is constructed such that it can be exploited to, e.g., reveal secrets via a malicious PR.
- Actions that are used by our CI are updated to include harmful code.
(1) can be fully addressed, in principle. See, e.g., tools like zizmor.
(2) is a much more difficult problem to handle, since even when using a SHA to pin an action, updating the version (via dependabot or by updating the hash) is risky unless all patches to the action have been examined.
Recently in the news: changed-files-action compromised
Github side:
There are two primary threat vectors via GitHub actions:
(1) can be fully addressed, in principle. See, e.g., tools like zizmor.
(2) is a much more difficult problem to handle, since even when using a SHA to pin an action, updating the version (via dependabot or by updating the hash) is risky unless all patches to the action have been examined.
Recently in the news: changed-files-action compromised
Github side: