corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08732-37fa-7064-9b2e-d3b5d2b967b0

Beyond the OIDC Silver Bullet: Why "Keyless" GitHub Actions Aren't Enough

austen.info · published 3 June 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at austen.info Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
67
Words captured
2,586

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect
docs.github.com
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
docs.aws.amazon.com
https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions
docs.github.com
https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication
docs.github.com
https://docs.github.com/en/code-security/supply-chain-security
docs.github.com
https://tailscale.com/kb/1276/tailscale-github-action
tailscale.com
https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/
developers.cloudflare.com
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised
stepsecurity.io
https://about.codecov.io/security-update/
about.codecov.io
https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
safedep.io
https://www.stepsecurity.io/blog/ghostaction-campaign-over-3-000-secrets-stolen-through-malicious-github-workflows
stepsecurity.io
https://www.stepsecurity.io/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages
stepsecurity.io
https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
docs.github.com
https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment
docs.github.com
https://docs.github.com/en/actions/deployment/targeting-different-environments/managing-environments-for-deployment
docs.github.com
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
docs.github.com
https://nesbitt.io/2026/04/28/github-actions-is-the-weakest-link.html
nesbitt.io
https://www.stepsecurity.io/blog/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltrates-ci-cd-credentials
stepsecurity.io
https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
docs.github.com
Postmortem: TanStack npm supply-chain compromise Read at the source ↗
tanstack.com
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows
docs.github.com
https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
securitylab.github.com
https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use
en.wikipedia.org
https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
medium.com
https://docs.github.com/en/enterprise-server@latest/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise
docs.github.com
https://docs.github.com/en/actions/using-jobs/using-jobs-in-a-workflow
docs.github.com
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds
docs.github.com
https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts
docs.github.com
https://github.com/aws-actions/configure-aws-credentials
github.com
https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
docs.github.com
https://docs.github.com/en/actions/using-workflows/reusing-workflows
docs.github.com
https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/
github.blog
https://docs.github.com/en/actions/reference/security/secrets
docs.github.com
https://github.com/step-security/harden-runner
github.com
https://ebpf.io/what-is-ebpf/
ebpf.io
https://docs.stepsecurity.io/guides/how-to-restrict-network-connections-to-explicitly-allowed-endpoints
docs.stepsecurity.io
https://docs.npmjs.com/cli/v10/using-npm/registry
docs.npmjs.com
https://docs.stepsecurity.io/github-actions/harden-runner/detections
docs.stepsecurity.io
https://docs.github.com/en/actions/concepts/runners/about-github-hosted-runners
docs.github.com
What’s coming to our GitHub Actions 2026 security roadmap Read at the source ↗
github.blog
https://docs.github.com/en/rest/meta/meta
docs.github.com
https://docs.npmjs.com/cli/v10/configuring-npm/package-lock-json
docs.npmjs.com
https://docs.npmjs.com/cli/v10/commands/npm-ci
docs.npmjs.com
https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
docs.github.com
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
docs.github.com
https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
docs.github.com
https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database
docs.github.com
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
docs.github.com
https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches
docs.github.com
https://github.com/actions/setup-node
github.com
https://docs.github.com/en/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization
docs.github.com
https://www.paloaltonetworks.com/blog/cloud-security/trivy-supply-chain-attack/
paloaltonetworks.com
https://ramimac.me/imposter/
ramimac.me
https://github.blog/security/supply-chain-security/how-to-stay-safe-from-repo-jacking/
github.blog
https://github.blog/open-source/git/sha-256-support-in-git/
github.blog
https://www.cisa.gov/zero-trust-maturity-model
cisa.gov
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
docs.aws.amazon.com
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
docs.aws.amazon.com
https://tailscale.com/kb/1018/acls
tailscale.com
https://docs.github.com/en/actions/concepts/runners/private-networking
docs.github.com
https://docs.github.com/en/actions/how-tos/manage-runners/larger-runners/about-larger-runners
docs.github.com
https://docs.github.com/en/actions/how-tos/manage-runners/github-hosted-runners/connect-to-a-private-network/connect-with-oidc
docs.github.com
https://docs.github.com/en/enterprise-cloud@latest/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/about-azure-private-networking-for-github-hosted-runners-in-your-enterprise
docs.github.com
https://github.com/zizmorcore/zizmor
github.com
https://github.blog/changelog/2025-01-23-codeql-now-analyzes-github-actions-workflows/
github.blog
https://docs.stepsecurity.io/harden-runner
docs.stepsecurity.io
https://github.com/ossf/scorecard
github.com