{"id":94975,"date":"2026-04-01T12:20:12","date_gmt":"2026-04-01T19:20:12","guid":{"rendered":"https:\/\/github.blog\/?p=94975"},"modified":"2026-04-01T12:20:15","modified_gmt":"2026-04-01T19:20:15","slug":"securing-the-open-source-supply-chain-across-github","status":"publish","type":"post","link":"https:\/\/github.blog\/security\/supply-chain-security\/securing-the-open-source-supply-chain-across-github\/","title":{"rendered":"Securing the open source supply chain across GitHub"},"content":{"rendered":"\n

Over the past year, a new pattern has emerged in attacks on the open source supply chain. Attackers are focusing on exfiltrating secrets (like API keys) in order to both publish malicious packages from an attacker-controlled machine as well as gain access to more projects in order to propagate the attack.<\/p>\n\n\n\n

These attacks often start by compromising a workflow on GitHub Actions.<\/p>\n\n\n\n

Let’s talk through what you can do today to secure your GitHub Actions workflows, what work GitHub has been doing to secure open source, and what to expect in the coming months for further security enhancements.<\/p>\n\n\n\n

What you can do today<\/h2>\n\n\n\n

Many of these attacks start by looking for exploitable GitHub Actions workflows.<\/p>\n\n\n\n

The most critical action you can take is to enable CodeQL to review your GitHub Actions workflow implementation<\/a><\/strong> (available for free on public repositories) to inspect your workflows for security best practices.<\/p>\n\n\n\n

Next, review our detailed actions security guidance<\/a>. In particular:<\/p>\n\n\n\n