gha-security-review

To check GitHub Actions workflows for security vulnerabilities, analyze YAML files under .github/workflows to validate triggers, permissions, and secret exposure, identifying exploitable paths and mitigation gaps.

The pull_request_target vulnerability in GitHub Actions occurs when workflows execute code from untrusted forks with elevated secrets access, allowing attackers to leak credentials or achieve remote code execution through malicious pull requests.

To prevent secret exposure in GitHub Actions CI workflows, review workflow permissions, restrict trigger configurations, apply safe-guarded defaults, and ensure secrets are not accessible to untrusted pull request execution contexts.

Yes, you can remediate unpinned actions in GitHub Actions workflows by applying concrete remediation guidance that maps reference vulnerabilities to safe-guarded defaults, ensuring actions are securely pinned and validated against threat models.

Yes, this security review process applies to all workflow definitions under .github/workflows and related action definitions, validating triggers, permissions, and secret exposure to determine exploitable paths across the repository.

Threat modeling for GitHub Actions YAML configurations is required to systematically validate trigger conditions, permissions, and secret handling, producing concrete remediation guidance that closes exploitable paths and prevents credential leakage.