Five mistakes in a workflow file let a stranger run commands or read secrets: risky triggers, injected text, loose pins, a wide token and leaked values.
A GitHub Actions workflow becomes dangerous when it lets text or code written by a stranger reach a place that has power: a shell, a checked-out branch with secrets in scope, or a token that can write to the repository. Nearly all serious incidents here fit one of five patterns, and all five can be spotted by reading the YAML file alone. This guide walks through them in the order a reviewer should check, shows what the safe version looks like, and ends with the cases where the advice is less useful than it sounds.
Read the full report on AISkills402: https://aiskills402.com/blog/github-actions-workflow-risks?utm_source=devto&utm_medium=social
Top comments (0)