GitHub Actions trust

Tags: supply-chain, github-actions, ci

Level: advanced

Method

1. Read the workflow files you are allowed to see

   Look at on: triggers, permissions:, and which secrets the job can reach. A public default workflow is not a finding.

   Tools: browser

2. Separate pull_request from pull_request_target

   pull_request from a fork runs with a restricted token. pull_request_target does not. The trigger name is the first fact.

   Tools: browser

3. See what code the job executes

   A checkout of the pull request head, or a script taken from the PR, inside a pull_request_target job is the dangerous shape. A job that only reads the PR title is a different, smaller question.

   Tools: browser

4. OIDC to cloud

   If the workflow requests an OIDC token for a cloud role, note which ref and event the cloud trust policy allows. A policy that trusts every pull request is the design note.

   Tools: browser

5. Artifacts

   An artifact uploaded by an untrusted job and downloaded by a privileged job is a handoff. Record the two jobs. Do not plant a file in a repository you do not own.

   Tools: browser

6. Stay inside the program

   CI is in scope only when the program says so. Reading a public workflow is not permission to open a pull request that runs it.

   Tools: browser

Field notes

• OWASP Top 10:2025 A03 is the supply-chain category. A missing integrity check on one artifact is closer to A08.
• pinning third-party actions to a commit is a control. A floating tag is a lead, not automatically a paid bug.
• Do not print secrets in a log to prove they exist.

References

• https://docs.github.com/en/actions/reference/security/secure-use
• https://owasp.org/Top10/2025/