News for hackers. Stuff that matters.

A comment on GitHub Actions is the weakest link.

Re:GitHub Actions is the weakest link by ossianericson on Tuesday April 28, 2026 @02:52PM (#47938831)
The OIDC federation between the runner and the cloud resources it touches , that credential gets created once. Permissive enough to not block the first deploy, and it is not what is reviewed when a pinning incident happens. Every one is looking at the action. The identity it runs as just sits there.
[ Parent | on HN ]
Re:GitHub Actions is the weakest link by nulltrace on Tuesday April 28, 2026 @03:56PM (#47939773)
Common mistake is trusting the repo instead of the workflow. Then any workflow inherits the same cloud access.
[ Parent | on HN ]