ATTACKERS LOVE YOUR GITHUB ACTIONS TOO

Summary from the TLDR InfoSec newsletter

GitHub ranks as the second most used CI/CD tool, but it also exposes a large attack surface to attackers. GitHub Actions can unintentionally expose secrets or overprovision tokens. Actions are vulnerable to supply chain compromise via poisoned dependencies and injection attacks.