GitHub adds approval checks for suspicious Actions workflows

GitHub has introduced an automatic approval step for certain GitHub Actions workflow runs in public repositories. The platform now holds potentially suspicious workflows before execution begins, pending review.

How it works

When GitHub flags a workflow as potentially malicious, the run is paused. A repository collaborator with write access must approve it through an authenticated web session. Without approval, the workflow will not execute.

The measure targets supply chain attacks involving compromised GitHub accounts. Attackers can use hijacked accounts to add or modify Actions workflows, extract CI/CD credentials, and launch additional attacks through repository automation.

Risks and recommendations

GitHub Actions workflows can access repository tokens, stored secrets, package-publishing credentials, and external services depending on configuration. A malicious workflow that obtains these credentials can use them outside the affected repository.

GitHub advises maintainers to:

• Grant only the permissions required for each job to the auto-generated GITHUB_TOKEN
• Avoid running untrusted pull-request code in workflows with write access or secret retrieval
• Pin third-party Actions to full commit hashes where possible
• Separate workflows that publish software or access sensitive credentials from those processing external contributions

GitHub emphasizes this control does not replace existing safeguards for token permissions, secret management, or third-party Actions usage.

Similar protections are being added to GitHub’s other supply chain services. Dependabot now uses malware advisories from the OpenSSF malicious-packages repository, and automatic scanning is in place for newly published npm packages.

The feature currently applies to public repositories hosted on GitHub.com and is not yet available for GitHub Enterprise Server deployments.

Sources

• GitHub adds approval checks for suspicious Actions workflows
• GitHub Actions holds potentially malicious workflows for approval