wrdn-gha-workflows

Auditing GitHub Actions workflows for expression injection involves tracing attacker-controlled inputs from triggers and PR contexts to privileged execution sinks to identify unsafe data flows. This process maps entry points and privilege boundaries to produce actionable mitigations.

pull_request_target and workflow_run triggers are risky because they execute with elevated privileges and secrets. If attacker-controlled inputs from pull request contexts or artifact flows reach privileged execution steps without validation, they can lead to pwn requests and secret exposure.

Checking reusable workflows for secret exposure requires tracing untrusted data from workflow_call inputs through runs and actions to identify if attacker-controlled data reaches privileged steps. Input validation and environment-passing hardening mitigate these unsafe data flows.

Yes, you can scan chatops and comment-driven GitHub Actions commands by tracing untrusted data from issue or PR comments to privileged execution sinks. This identifies where attacker-controlled inputs bypass privilege boundaries and reach sensitive workflow steps.

Securing third-party GitHub Actions involves pinning actions to specific commit SHAs, validating inputs, and applying environment-passing hardening. Auditing action manifests and repo-local flows ensures attacker-controlled inputs cannot reach privileged execution sinks.