Verifiable GitHub Actions with eBPF
summary
A GitHub Action wraps the eBPF-based Tracee runtime to profile and verify builds: it starts and stops tracing, blocks the workflow until the tracer is ready, and creates a baseline profile of executions, file writes and DNS/network activity that is committed alongside code. Signatures flag known bad behaviors while profiles enforce allowed behavior; Tracee switches from execve to the kernel process exec event, records arguments (with ignore rules) and offers opt-in env capture. The project adds eBPF-based Tracee GitHub Action, compile-once BTF Hub for portability, and multiscopes for filtered tracing and it demonstrably detects and prevents an altered uploader that modified source during the build.
AI-written summary · about
chapters (18)
- 0:00Supply chain security intro
- 2:06Early supply chain attacks
- 3:29First Tracy attempt in GitHub Actions
- 5:38Build vs runtime differences
- 7:03Profiling pipeline behavior
- 9:51Signatures and profiles approach
- 11:12Live Tracy demo in workflow
- 16:35eBPF challenges in CI
- 19:26Complete event capture
- 21:12Filtering GitHub Actions noise
- 23:24Multi-scope tracing in Tracy
- 25:34Tracing builds
- 31:56Detecting process executions
- 32:18File modifications in pipelines
- 34:11Network activity in builds
- 36:59Tracy data for SBOM
- 38:45Key lessons recap
- 39:49Q&A
related talks
27mVerifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee
36mSecuring CI/CD Systems Through eBPF
23mBreaking the Build: How Attackers Abuse GitHub Actions
40mExploring Runtime Security and Forensic using eBPF
36mDebugging with eBPF on Arm Platforms
54mTracing Go Programs with eBPF!
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?