Preview of State of GitHub Actions Security Report: Security of GH Workflows Building Blocks

This report analyzes the security posture of GitHub Actions workflows across 2.5M files and finds systemic risks: dangerous triggers (e.g., pull_request_target, workflow_run) that can lead to RCE, widespread lack of dependency pinning (98.4%), default overly‑privileged workflow tokens, and unsafe use of self‑hosted runners. It provides concrete recommendations—avoid or gate risky triggers, minimize token permissions, pin action references, and restrict self‑hosted runners—to mitigate supply‑chain and execution‑context attacks.