Technology

GitHub Actions

GitHub's automation that builds, tests and releases code, often with access to secrets.

Workflows run on every push or pull request and frequently hold publishing tokens and cloud credentials. A workflow that runs untrusted code, or a compromised third-party action, can leak those secrets and let attackers publish poisoned releases.