PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Harden GitHub Actions: An Updated Guide

wiz.io | blog | #supply-chain | #devsecops | #github-actions | #ci-cd | #best-practices | #hardening
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz's updated GitHub Actions hardening guide distills the trivy-action and Axios incidents into practical controls, covering platform features like SHA pinning and immutable releases.
Published
Collected

Related coverage

blog · wiz.io
The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)
Part 2 of Wiz's GitHub Actions research: AI actions from OpenAI, Anthropic, and Google have config bypasses outsiders can trigger; dynamic credential files create a novel exfiltration vector.
blog · wiz.io
From Code to Pipeline: Wiz Code Now Secures Your Build Environment
Wiz Code expands to the build environment: controls for workflow triggers, job permissions, and third-party actions, addressing pipeline supply chain attacks and AI agents entering CI/CD.
blog · wiz.io
Primer on GitHub Actions Security - Threat Model, Attacks and Defenses (Part 1/2)
Part one of a GitHub Actions security primer: the trusted vs untrusted threat model, three risks — PR pwnage, script injection, third-party components — seen in tj-actions, Ultralytics, Trivy.
blog · wiz.io
Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign
Wiz Research traced six waves of pull_request_target exploitation to one actor three weeks before disclosure: 500+ PRs, two npm packages hit, payloads evolving from bash to AI-generated.
blog · about.gitlab.com
GitLab Transcend: Speed you can trust, all the way to production
Every new GitLab innovation announced at Transcend: what shipped, what's coming, and how to get started.
blog · about.gitlab.com
How to design GitLab for enterprise scale
A guide to enterprise GitLab rollouts comparing GitLab.com, Dedicated, and self-managed models, with planning guidance for runners, availability, disaster recovery, and pipeline performance at scale.
Back