Connecting a service to a repository or a pipeline takes a few clicks, and the service then holds tokens or runs code with your permissions. When a vendor or an action is compromised, as Codecov's uploader and tj-actions/changed-files were, every customer job that trusted it is exposed.
- Vet each third-party service before it gets access, and grant it least privilege.
- Keep an inventory of every integration method: apps, plugins, OAuth applications, tokens and actions, with the permissions granted and used.
- Run third-party tools in jobs without deploy or publish credentials, pin them to immutable versions and verify what you download.
- Review integrations periodically and remove the ones no longer in use.
Guides on this site
Case study: the Codecov Bash Uploader compromise (2021)
How a credential leaked through Codecov's Docker image process let an attacker change the Bash Uploader that many CI pipelines downloaded and ran, which sent their environment variables, and the secrets in them, to the attacker for two months in 2021.
Case study: the tj-actions/changed-files compromise (CVE-2025-30066)
In March 2025 an attacker moved the version tags of a popular GitHub Action, and of a reviewdog action before it, to code that printed CI secrets into build logs. This case study traces the token chain back to one pull_request_target workflow, sizes the exposure, and shows how it was caught and which controls held.
Harden GitHub Actions against workflow and supply-chain attacks
Close the paths that give untrusted pull-request code secrets or a write token: pass context through env, keep pull_request_target away from fork code, pin actions to commit SHAs, scope GITHUB_TOKEN and OIDC, and treat artifacts as data.
Practice
Gaps on this site
The guides cover pinning and isolating third-party actions and CI tools. No guide here inventories and reviews the GitHub Apps, OAuth apps and tokens connected to an organization.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.