GitHub Actions 将疑似恶意工作流暂停等待审批
英文标题：GitHub Actions holds potentially malicious workflows for approval
近期供应链攻击会利用被盗用的 GitHub 凭据推送恶意 GitHub Actions 工作流，以窃取 CI/CD 凭据并发起后续攻击。为保护公共仓库，GitHub Actions 现会在部分工作流运行被识别为疑似恶意时，暂停其执行并等待审批。拥有仓库写入权限的协作者必须通过已认证的 Web 会话审核并批准后，工作流才能继续运行。该保护机制无需配置，但目前仅适用于 github.com 上的公共仓库，GitHub Enterprise Server 暂未提供此功能。
16.2 KB
25.6 KB
中文
近期的供应链攻击会利用已被攻破的 GitHub 凭据推送恶意 GitHub Actions 工作流，这些工作流可窃取 CI/CD 凭据并实施进一步攻击。为帮助公共仓库防范此类攻击，GitHub Actions 现在会在某些工作流运行开始前将其暂停，等待审批。
当某个工作流运行被识别为可能存在恶意行为并被暂停时，该工作流不会执行，直到拥有写入权限的仓库协作者完成审核并批准。审批必须通过已认证的 Web 会话提交。获得批准后，工作流将正常继续运行。
你无需配置此保护功能；GitHub 会自动应用该机制。
该保护目前仅适用于 github.com 上的公共仓库。GitHub Enterprise Server 目前不会提供此保护。
English / 原文
Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these attacks, GitHub Actions now holds certain workflow runs for approval before they start.
When a workflow run is identified as potentially malicious and held, the workflow won’t execute until a repository collaborator with write access reviews and approves it. The approval must be submitted through an authenticated web session. Once approved, the workflow continues normally.
You don’t need to configure this protection; GitHub applies it automatically.
This protection currently applies to public repositories on github.com only. GitHub Enterprise Server doesn’t add this protection at this time.