Guarding the pipeline: Hardening GitHub actions against supply chain attacks

GitHub Actions is a widely adopted continuous integration and continuous delivery (CI/CD) platform that enables organisations to automate build, test, and deployment workflows at scale. However, as adoption has grown, CI/CD pipelines have increasingly become high-value targets for attackers, quietly becoming one of the most attractive targets in modern software supply chain attacks.

Recent industry reports and threat intelligence indicate a sharp rise in software supply chain attacks, particularly across ecosystems such as NPM and PyPI. These attacks commonly exploit techniques such as dependency confusion, malicious package publication, and repository takeovers. The financial and operational impact is significant, with global losses estimated at over 45 billion in 2023 and projected to exceed 80 billion by 2026.

Notable recent real-world incidents including compromises of projects like Axios, Trivy, and LiteLLM highlight how attackers can pivot through CI/CD pipelines to impact thousands of downstream users. GitHub Actions workflows often operate with elevated privileges and access to sensitive environments, making them a potential bridge into restricted network zones and production systems. Ensuring the integrity and security of these pipelines is therefore critical to defending modern software delivery processes.

In this talk, we will analyse the evolving threat landscape targeting CI/CD systems, with a focus on GitHub Actions. We will get a comprehensive overview of GitHub Actions security, detailing common threats and vulnerability patterns. This talk cuts through the noise and focuses on what actually matters: how these attacks work in practice, where GitHub Actions pipelines are commonly misconfigured, and what you can realistically do to secure them. Attendees will gain practical, actionable guidance on hardening GitHub Actions workflows to mitigate modern supply chain risks.