The case for GitHub Actions security after recent supply chain attacks

This report reviews recent high-profile attacks against GitHub Actions—s1ngularity, hackerbot-claw, and TeamPCP—highlighting workflow vulnerabilities (e.g., misuse of pull_request_target, script injection from untrusted inputs, and unpinned/retagged actions) that enable remote code execution and supply-chain compromise; it provides prevalence data (large fractions of organizations exposed), describes GitHub’s roadmap for mitigations (dependency locking, scoped secrets, observability and egress controls), and recommends defensive practices such as avoiding elevated triggers, treating workflows as untrusted input surfaces, and pinning actions to commit SHAs.