GitHub is including a human checkpoint earlier than sure suspicious Actions workflows can run in public repositories.
The corporate introduced on July 28, 2026, that workflow runs it identifies as probably malicious might be held earlier than execution. A repository collaborator with write entry should assessment and approve the run by an authenticated GitHub net session earlier than it could proceed.
The safeguard requires no configuration and at present applies solely to public repositories on GitHub.com. GitHub Enterprise Server doesn’t obtain the safety.
Repository house owners nonetheless must resolve who ought to assessment held runs and what proof must be required earlier than approval. That duty falls totally on open-source maintainers, group directors, DevOps groups and safety leaders overseeing CI/CD permissions and software program provide chain dangers.
How GitHub’s workflow maintain works
When GitHub flags a run, the workflow stays paused till a certified collaborator approves it. As soon as accepted, it continues usually.
GitHub has not disclosed the detection alerts, thresholds or anticipated false-positive price behind the safeguard. The maintain due to this fact provides a assessment checkpoint however doesn’t assure that each malicious workflow might be detected.
The corporate linked the change to assaults through which compromised GitHub credentials had been used to push malicious workflow information. That danger was demonstrated in Might when an npm provide chain assault focused developer credentials, together with GitHub tokens, API keys and inside secrets and techniques.
Attacker-controlled workflow execution might expose cloud credentials, bundle registry tokens or a repository’s GITHUB_TOKEN, in keeping with safety steerage from OWASP. The potential attain of stolen credentials turned clearer after a GitHub flaw uncovered developer OAuth tokens, which may have offered entry to non-public repositories and organizational code.
The automated maintain is separate from a June 18 replace to actions/checkout. Model 7 and up to date supported variations reject widespread configurations that retrieve unreviewed fork code throughout privileged pull_request_target or sure workflow_run executions.
That assault sample is usually referred to as a “pwn request.” The actions/checkout change blocks specified fork head and merge checkouts, nevertheless it doesn’t stop each technique of retrieving and executing untrusted code.
What repository house owners ought to verify
Outline approval standards. Overview who initiated the run, what modified below .github/workflows/, which permissions it requests and whether or not it downloads or executes unfamiliar code. Escalate unclear instances as an alternative of approving them merely to clear the queue.
Audit unsafe overrides. Workflows can bypass the safer actions/checkout habits with the allow-unsafe-pr-checkout enter. GitHub describes opting out as a deliberate safety choice, so every use ought to have a documented goal, proprietor and danger assessment.
Examine pinned variations. Workflows utilizing a supported floating main tag, reminiscent of actions/checkout@v4, acquired the backported safety robotically. References pinned to a commit SHA, minor model or patch model require an replace. Model 1 doesn’t obtain the change.
Take a look at execution insurance policies. GitHub’s separate workflow execution protections enable directors to regulate which actors can set off workflows and which occasions are permitted. Comparable access-policy gaps just lately left Azure accounts uncovered when Conditional Entry guidelines didn’t cowl a command-line authentication path.
GitHub’s insurance policies stay in public preview, and customers with repository write entry can set off workflows by default. Consider mode permits directors to determine what a proposed rule would block earlier than imposing it.
GitHub Enterprise Server directors ought to assessment the protections accessible of their put in model quite than assume the GitHub.com safeguard applies to them. Public repository house owners ought to assign approved reviewers, doc the proof required for approval and set up an escalation path earlier than the primary suspicious run is held.
Learn extra: A separate incident reveals what compromised repository entry can allow after a stolen GitHub token uncovered Grafana’s codebase.
