GitHub Actions - Updated Guide for Enhanced Security

What Happened

Over the past few years, researchers have raised alarms about the vulnerabilities in GitHub Actions. In March 2025, the tj-actions incident revealed the extent of these threats, leading to compromised workflows and leaked credentials. Just a year later, new attacks emerged, notably involving TeamPCP and Axios, which further exploited GitHub Actions vulnerabilities.

Who's Affected

What Changed

In response to these incidents, GitHub has introduced several security measures, including SHA pinning enforcement and immutable releases. These updates aim to bolster the security of workflows and protect against unauthorized access.

Key Security Practices

To effectively secure GitHub Actions, organizations should consider the following practices:

1. Set Read-Only Default Workflow Permissions: Ensure that workflow token permissions are set to read-only to prevent unauthorized modifications.
2. Limit Actions to Verified Sources: Control which actions can run by restricting workflows to verified actions from trusted sources.
3. Govern Workflow Adoption: Use repository allowlists to restrict where workflows can be adopted and limit self-hosted runners to specific repositories.
4. Implement Branch Protection: Enforce rules before code can be merged to ensure only trusted code enters your main branches.
5. Manage Secrets Wisely: Use repository, organization, and environment-level secrets effectively to minimize exposure.

Defensive Measures

Organizations should regularly review their GitHub Actions configurations to ensure compliance with security best practices. Implementing commit signing and out-of-band detection can provide additional layers of protection against potential attacks. Furthermore, enabling immutable releases for published actions can safeguard against tag-rewriting attacks.

By following these guidelines, teams can create a more resilient environment for their GitHub Actions workflows, reducing the risk of future incidents.