WORKFLOWS

Summary from the TLDR InfoSec newsletter

The recommended method for pinning GitHub Actions per GitHub is to pin the action to a full commit hash which causes the tarball of the action to be downloaded. However, some actions can still be exploited through supply chain attacks if they depend upon unpinned external dependencies (docker containers, other actions, etc). A total of 32% of the top started actions were deemed unpinnable. This article concludes with advice to mitigate unpinnable action attacks