GitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
summary
Shows how issue text or PR branches can inject shells and exfiltrate secrets (demo steals secrets from an issue), and counts from the recent worm: ~25,000 malicious repos created, ~33,000 unique secrets exposed, 5–10% AWS keys. Recommends pin actions by SHA, sanitize user input via env vars, use OIDC short‑lived tokens and scoped environments, avoid pull_request_target and caches for release jobs, run automated checks (OSS Scorecard, Dependabot, and the zsecurity/zsmore-style scanners) and enforce org-level allowlists and least-privilege tokens.
AI-written summary · about
chapters (13)
- 0:00GitHub Actions security intro
- 3:23Pipelines as attack targets
- 11:09Third-party action risks
- 15:47Immutable dependencies vs attacks
- 17:33Script injection via input
- 20:03PR workflow dangers
- 24:47Cache poisoning risks
- 26:31Supply chain attack analysis
- 30:24Securing secrets in workflows
- 35:45Automating security checks
- 40:01Live security hardening demo
- 48:38Advanced Sysmoore checks
- 50:00Securing the whole pipeline
related talks
45mGitHub Actions & Security
15mGitHub Actions: a time bomb for supply chain security
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
25mWhen the supply chain hits a sour note
42mProtecting CI/CD from malicious deploys
28mPwning the CI (with GitHub Action Workflows)
56mHow to use GitHub Actions with Security in mind
57mGitHub Actions: A Cloudy Day for Security