MITIGATING ATTACK VECTORS IN GITHUB WORKFLOWS

Summary from the TLDR InfoSec newsletter

A comprehensive guide from OpenSSF on various GitHub Workflows vulnerabilities and their mitigations. The guide covers running untrusted code in privileged workflows, code injections, vulnerable actions, malicious releases, tag-renaming attacks, imposter commits, and unsafe use of caches. It concludes by introducing the OpenSSF scorecard CLI tool and GitHub Action, which can be used to check for these vulnerabilities in a GitHub Workflow.