Protecting Your GitHub from Supply Chain Attacks
summary
Covers concrete defenses for GitHub repositories and GitHub Actions against recent supply-chain attacks (S1ngularity, Shai‑Hulud, TeamPCP) that affected projects like Trivy, Axios, Zapier and PostHog. Walks through locking down repo settings, hardening Actions workflows, configuring Dependabot and Renovate to protect Actions, and using npm security tools and automation to detect misconfigurations before they cause harm.
AI-written summary · about
related talks
15mGitHub Actions: a time bomb for supply chain security
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
38mFortifying Your Codebase with GitHub
25mWhen the supply chain hits a sour note
42mProtecting CI/CD from malicious deploys
23mBreaking the Build: How Attackers Abuse GitHub Actions
21mSupply Chain Attacks on Open Source: What's Happening, What...
56mHow to use GitHub Actions with Security in mind