gha-security-review

To audit GitHub Actions workflows for security vulnerabilities, scan the `.github/workflows/*.yml` files to identify exploitable attack patterns like pwn requests, expression injection, and credential theft. This process provides concrete exploitation scenarios and mitigation advice to secure your CI/CD pipelines.

A pwn request in GitHub Actions CI/CD security is an attack pattern where an external attacker exploits a workflow trigger to compromise the pipeline. Auditing workflows identifies these vulnerabilities alongside expression injection and credential theft, providing specific PoC scenarios and fixes to prevent unauthorized access.

To prevent expression injection in GitHub Actions workflows, audit your `.github/workflows/*.yml` configuration files to locate untrusted input handling vulnerabilities. The audit provides specific mitigation guidance and best practices to secure workflow expressions against malicious code execution.

Yes, you can scan your CI/CD pipelines for supply chain attacks before merging critical updates by auditing the `.github/workflows/` directory. This identifies security risks like credential escalation and provides concrete fixes to ensure your pipelines are secure against external attackers.

The limitations of auditing GitHub Actions workflow files include a strict focus on `.github/workflows/*.yml` and related configuration files. The audit targets specific attack vectors like expression injection, pwn requests, and credential theft, rather than providing a comprehensive application code security scan.