GitHub Actions CI/CD Security
The importance of Continuous Integration/Continuous Deployment (CI/CD) security has recently been underlined by guidance from the Cybersecurity & Infrastructure Security Agency (CISA) and the National Security Agency (NSA). As per their document Defending Continuous Integration/Continuous Delivery (CI/CD) Environments:
CI/CD environments have become attractive targets for malicious cyber actors (MCAs) aiming to introduce malicious code, steal intellectual property, or cause denial of service attacks against applications.
The increasing number of supply chain attacks on CI/CD environments, such as the infamous SolarWinds, Codecov, and ua-parser-js attacks, paints a vivid picture of this growing threat.
GitHub Actions, like other CI/CD platforms, execute untrusted code in a privileged environment. StepSecurity can help if you are worried about:
InstallationQuickstart