How to Prevent Poisoned GitHub Actions Dependencies

Your workflow uses actions/checkout@v4. Today, that tag points to a vetted release. Tomorrow, a compromised maintainer or attacker moves the tag to malicious code. Your pipeline runs it with access to GITHUB_TOKEN. Third-party Actions are dependencies. A floating tag behaves like an unpinned package dependency. If the reference changes, the... Weiterlesen