Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Harden GitHub Actions: An Updated Guide

wiz.io | blog | #supply-chain | #devsecops | #github-actions | #ci-cd | #best-practices | #hardening

Summary

Wiz's updated GitHub Actions hardening guide distills the trivy-action and Axios incidents into practical controls, covering platform features like SHA pinning and immutable releases.
Published
Collected

original ↗

Related coverage

  1. The Overlooked Attack Surface: Securing Code Repositories, Pipelines, and Developer Infrastructure (wiz.io)
  2. Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR (wiz.io)
  3. The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2) (wiz.io)
  4. From Code to Pipeline: Wiz Code Now Secures Your Build Environment (wiz.io)
  5. Primer on GitHub Actions Security - Threat Model, Attacks and Defenses (Part 1/2) (wiz.io)
  6. Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign (wiz.io)

back