Security
How to Check Your Repos for the GhostAction Workflow and Lock Down Actions
A fake security-audit workflow is stealing secrets from GitHub repositories. Here are the searches, the cleanup order, and the settings that stop it.
#GitHub Actions
3 articles3 articles on Backtrace tagged "GitHub Actions."
3 articles
-
-
DevOpsHow to Use GitHub Actions Workflow Lockfiles to Pin Every Dependency
GitHub's new actions.lock file records the exact commit behind each action. Here is how to create it, keep it current and avoid the allowlist trap.
-
Securitynpm SlugFest Explained: How Trusted Publishing Let Attackers Hijack 1,500 Packages
A naming flaw in npm Trusted Publishing exposed more than 1,500 packages to takeover with no stolen credentials. Here is how SlugFest worked and what to audit now.