GitHub says Actions now automatically pauses certain suspicious workflow runs in public repositories until a write-access collaborator approves them, adding a human checkpoint for maintainers after supply-chain attacks abused compromised credentials.
GitHub Actions Holds Potentially Malicious Workflows for Approval
GitHub says Actions now automatically pauses certain suspicious workflow runs in public repositories until a write-access collaborator approves them, adding a human checkpoint for maintainers after supply-chain attacks abused compromised credentials.
Source: GitHub Blog