GeistHaus
log in · sign up

GitHub "Actions" Are An Impending Security Disaster

cedwards.xyz

You may already be familiar with GitHub’s CI/CD offering, GitHub Actions. Confusingly, “Actions” refers not only to the CI/CD platform, but also reusable steps within workflows that anyone can publish on the Marketplace. Actions are published through ordinary repositories hosted on GitHub. GitHub itself provides many useful official Actions, such as checkout which checks out a repository. It can be used like this: - name: Checkout uses: actions/checkout@v4 actions/checkout refers to the organisation and repository where the Action code is hosted, and v4 refers to the git tag to use. Herein lies, in my opinion, a severe issue with Actions.

0 pages link to this URL

No pages have linked to this URL yet.