GitHub Actions 将潜在恶意工作流设为待审批
近期的供应链攻击利用被攻陷的 GitHub 凭据推送恶意的 GitHub Actions 工作流，以窃取 CI/CD 凭据并实施进一步攻击。为帮助保护公共仓库免受此类威胁……
GitHub Actions holds potentially malicious workflows for approval
详细说明
Back to changelog
Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these attacks, GitHub Actions now holds certain workflow runs for approval before they start.
When a workflow run is identified as potentially malicious and held, the workflow won’t execute until a repository collaborator with write access reviews and approves it. The approval must be submitted through an authenticated web session. Once approved, the workflow continues normally.
You don’t need to configure this protection; GitHub applies it automatically.
This protection currently applies to public repositories on github.com only. GitHub Enterprise Server doesn’t add this protection at this time.
Share
Copied
Shared
Back to changelog