buildOne report1 publisher GitHub Actions' default one-commit checkout let 41 pull requests skip their tests over three weeks while CI stayed green, a dev.to author reports. The author's change-detection step read git's fatal error as an empty diff, and the run that exposed it showed a test job that finished in 4 seconds.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+6
- Incentives
- Insufficient
- Confidence60
buildOne report1 publisher Scanner authors writing on dev.to hand-checked 60 public pull_request_target workflows and judged 6 exploitable by anyone who can open a pull request. About as many looked dangerous and were safe, so an audit has to read what runs after the checkout.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+5
- Incentives60
- Confidence40
GitHub's workflow execution protections went generally available on September 17, and the evaluate mode that shows what a rule would block before enforcement is documented as an Enterprise Cloud capability.
Reality
- Evidence58
- Adoption25
- Hype gap+12
- Incentives58
- Confidence54
buildOne report1 publisher Pinning a workflow to a commit SHA stops the tag moving under you, and resolving all 31 from the upstream repositories turned up an action whose v3 tag stopped moving at all while its releases reached v5.0.0.
Reality
- Evidence64
- Adoption28
- Hype gap+8
- Incentives72
- Confidence55
buildOne report1 publisher GitHub gives forked pull requests a read-only token and no secrets, so any test that needs a credential fails. The two documented ways around that differ in whose code the secrets-bearing job actually checks out.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap−5
- Incentives28
- Confidence52
The maintainers date the second wave to March 19, eighteen days after they disclosed the first one and rotated credentials without doing it all at once, and the only action tag that came through clean was one GitHub had already frozen.
Reality
- Evidence74
- Adoption52
- Hype gap−14
- Incentives68
- Confidence61
buildOne report1 publisher For anyone running pull_request_target, pinning v7 starts with a workflow audit rather than a version bump, and the credential relocation underneath it carries a runner version floor that self-hosted fleets should check first.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+35
- Incentives55
- Confidence30