GitHub Automatically Holds Suspicious Actions Runs, but Repository Owners Must Approve Them

GitHub announced a new automatic human review checkpoint that pauses workflow runs it flags as potentially malicious in public repositories until a repository collaborator with write access authorizes the run; the article explains how the hold works, its limitations (applies only to GitHub.com public repos, detection signals undisclosed), links the change to prior supply-chain attacks involving stolen tokens and credentials, and provides owner guidance on approval criteria, auditing unsafe overrides, pinning versions, and testing execution policies.