Loading story…
Semgrep has enabled organization-wide enforcement requiring GitHub Actions to be pinned to full 40-character commit SHAs, expanding a supply-chain hardening effort prompted by the compromise of the tj-actions/changed-files action. The rollout covered about 350 repositories and addressed more than simple tag replacement, including workflows that referenced branches and transitive dependencies introduced through composite actions and reusable workflows. GitHub’s control is designed to prevent mutable references from silently changing, and the effort aligned with broader guidance around immutable releases and action integrity.
The deployment used automation to find and remediate directly unpinned actions, while Renovate was used to keep pinned SHAs updated over time. Semgrep also worked through edge cases involving internal actions, reusable workflows, archived repositories, and abandoned third-party dependencies before moving from staged repository-level enforcement to an organization-wide policy. The result was a broad lock-down of GitHub Actions references intended to reduce the risk of future CI/CD supply-chain compromise.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
In early 2025, attackers changed every tagged release of tj-actions/changed-files to point to a malicious commit. Repositories using the action by tag rather than a full 40-character commit SHA would execute malicious code when workflows ran.
After resolving remaining issues and cleaning up archived or inactive repositories, Semgrep enabled GitHub's full-length SHA-pinning requirement organization-wide. Renovate was used to keep pinned action references updated after enforcement was in place.
Semgrep first turned on SHA-pinning enforcement at the repository level and monitored for workflow failures. This staged rollout exposed issues such as branch-based references, transitively unpinned internal actions, a reusable-workflow detection gap, and a problematic SLSA GitHub Generator reference.
Semgrep removed pre-commit/action from about 10 repositories because the project was in maintenance mode and contained an unpinned reference to actions/cache. This was part of remediating transitively unpinned third-party actions.
The rollout initially found about 100 repositories that required pinning remediation. After archiving roughly 20 repositories, the active remediation set dropped to about 80.
Motivated by the tj-actions/changed-files incident, Semgrep launched a rollout to enforce GitHub's setting requiring GitHub Actions to be pinned to full-length commit SHAs across roughly 350 repositories. The effort included automation to detect direct tag usage, branch references, and transitively unpinned actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
semgrep.dev
Open sourcedocs.github.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitHub rolled out new supply-chain protections across **GitHub Actions** and **npm** to curb attacks that abuse CI/CD workflows and malicious package publishing. On public repositories hosted on GitHub.com, workflow runs that GitHub flags as suspicious are now automatically paused until a repository collaborator with write access approves them through an authenticated web session. The safeguard is enabled by default and is aimed at attacks involving compromised GitHub credentials, malicious workflow files, and workflow-based secret theft or package tampering, though GitHub has not disclosed detection logic and said the control does not guarantee every malicious run will be caught. GitHub also introduced **publish-time malware scanning** for npm packages, shifting enforcement from scanning after publication to gating releases before they become available. Under the new process, a package can be published, held for review, or blocked based on scan results, alongside new dual-use metadata requirements such as `contentPolicy` and `DISCLOSURE`. The changes build on GitHub’s broader response to open-source supply-chain attacks, including guidance to pin third-party Actions to full commit SHAs, avoid unsafe `pull_request_target` usage, use **OpenID Connect** for secretless authentication, and rely on trusted publishing across ecosystems including **npm**, **PyPI**, **NuGet**, **RubyGems**, and **Crates**.
Jul 31, 2026
Security guidance from GitHub Security Lab and Semgrep warned that unsafe GitHub Actions patterns can let attackers execute code in CI, steal secrets, and modify repositories. A key risk is using the privileged `pull_request_target` trigger while also checking out code from an untrusted forked pull request, which runs attacker-controlled code with target-repository secrets and potentially write-capable `GITHUB_TOKEN` permissions. The guidance also highlighted shell injection risks when workflows interpolate untrusted GitHub context fields such as pull request titles directly into `run` steps, as well as the danger of re-enabling deprecated insecure commands through `ACTIONS_ALLOW_UNSECURE_COMMANDS`. The recommended mitigations focus on separating trust boundaries inside workflows. GitHub Security Lab advised using `pull_request` for untrusted forked PRs because it withholds secrets and write access, reserving `pull_request_target` only for limited privileged tasks such as labeling or commenting. It also recommended split-workflow designs in which untrusted PR code runs in one workflow and a separate `workflow_run` job consumes only safe artifact data, while warning that artifacts produced from untrusted PRs must still be treated as untrusted. Additional hardening steps included auditing third-party Actions, carefully handling environment variables and other untrusted inputs, enforcing branch protections, and scanning workflow files with Semgrep rules.
Jul 24, 2026
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026