GitHub Actions Supply Chain Attack: What DevOps Teams Need to Know

In March 2025, Palo Alto Networks’ Unit 42 revealed a clever and concerning supply chain attack exploiting GitHub Actions—a wake-up call for DevOps teams everywhere.

The Attack in a Nutshell

This wasn’t your usual malware or ransomware story. Instead, attackers targeted open-source projects by forking legitimate repositories, injecting malicious GitHub Actions workflows, and submitting pull requests back to the original projects.

Here’s the kicker: even without merging, GitHub automatically ran those workflows in the context of the fork. That gave attackers a window to execute code using GitHub’s CI/CD infrastructure—harvesting secrets, environment variables, and even cloud credentials in the process.

Why This Matters

The attack exploited a common GitHub Actions behavior—running workflows triggered by events like pull_request_target. While this is useful for enabling contributors to test their changes, it can also expose your secrets if not properly locked down.

More than 100 repositories were targeted, many unknowingly.

Key Lessons for DevOps Teams

1. Audit your workflows – Especially those using pull_request_target, workflow_run, or similar triggers. Understand what gets exposed and when.

2. Limit secrets access – Avoid making sensitive environment variables available to workflows triggered from forks.

3. Use secrets: none where possible – For public repositories, explicitly prevent secrets from being passed to workflows unless absolutely necessary.

4. Run CI on pull_request, not pull_request_target – The latter runs with write permissions and access to secrets, making it riskier.

5. Use ephemeral environments – Keep attack surfaces minimal. Avoid long-lived tokens or persistent credentials in workflows.

6. Set up secret scanning and detection – Tools like GitHub Advanced Security, Snyk, or custom pre-commit hooks can help catch leaks early.

Final Thoughts

Supply chain attacks are evolving. This one didn’t rely on breaking in—it relied on how automation is configured. That’s why as DevOps engineers, it’s on us to secure our pipelines, not just our applications.

Make time this week to review your GitHub workflows. One overlooked line of YAML could be all it takes.

Stay safe and automate responsibly,