medium10 pts · first answer countsdevsecopsgithub-actionssupply-chain

Pinning third-party actions

In 2025 attackers moved the version tags of a popular GitHub Action to a malicious commit that dumped secrets into logs. How do you protect your workflows from that kind of change?

A.Pin each third-party action to a full commit SHAB.Pin each action to a major tag such as @v4C.Use only actions that have many GitHub starsD.Run third-party actions on Windows runners only

Discussion 0

Join free to post in the discussion.

Pinning third-party actions

Discussion 0

Related questions