GitHub Actions Security in Python Packages
summary
Scans of thousands of Python package workflows using the static analyzer zizmor reveal concrete supply‑chain failures: about 85,000 unpinned third‑party actions, roughly 100,000 workflows with excessive GITHUB_TOKEN scopes, ~15,000 cache‑poisoning exposures and 21,000 template‑injection sites; 56,000 repos use the PyPI action but only 22% use trusted publishing, leaving ~44,000 on long‑lived tokens. The tool runs offline, outputs JSON/SQLite, and integrates into CI to block these specific misconfigurations.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:57GitHub Actions in Python
- 7:32Security risks and features
- 11:09Real-world compromises
- 13:36Analyzing 150k repos with Zizmore
- 15:01Top six Zizmore findings
- 20:18Cache poisoning
- 22:28Pull request target dangers
- 24:55GitHub’s security improvements
- 26:39Six hardening tips
- 29:07Key takeaways and closing remarks
related talks
44mSecuring CI/CD Pipelines: Exploring Vulnerabilities In Workflows
15mGitHub Actions: a time bomb for supply chain security
32mHacker Traction Through GitHub Actions: Is Your (Open Source) Project Safe?
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
17mIs My (Open Source) Project Safe?
55mGitHub Actions: Vulnerabilities, Attacks, And Counter-Measures
47mUnder the Radar: How we found 0-days in the Build Pipeline of OSS Packages
56mHow to use GitHub Actions with Security in mind