Hacking GitHub Actions

Most developers and security teams focus on securing the code they ship while overlooking the powerful automation infrastructure that builds, tests, and deploys it. GitHub Actions has quietly become one of the most privileged systems in modern software development. It has access to source code, secrets, release pipelines, and sometimes production itself. Making it an increasingly attractive target for attackers. In this talk, we'll explore how attackers can abuse GitHub Actions through a collection of real-world inspired attack techniques, including malicious pull requests, action hijacking, dependency substitution, cache poisoning, secrets leakage, and other CI/CD chaos. Along the way we'll discover why some GitHub Actions features are incredibly powerful, why some are accidental footguns, and why "just pin the version" doesn't solve all our problems.