GitHub Actions SHA Pinning: A Practical Security Review Checklist
Review GitHub Actions supply-chain risk with full commit-SHA pins, least-privilege permissions, and a repeatable pull-request checklist.
GitHub Copilot App Access Policy: An Enterprise Security Review Checklist
Review GitHub Copilot app access policies, managed settings, client separation, repository scope, and rollback evidence before enterprise rollout.
Copilot Code Review Agent Skills and MCP: A Security Review Checklist
A practical security review checklist for Copilot code review agent skills and MCP tools, with bounded permissions and human approval.
GitHub Actions Workflow Approval Holds: A Security Review Checklist
GitHub now holds certain potentially malicious GitHub Actions runs for approval in public repositories. Use this bounded review checklist before approving a held workflow.
GitHub Actions Self-Repository Actions: Security Review Checklist
GitHub has added a shorter way to reference an action or reusable workflow that lives in the same repository. The new self-repository syntax starts a uses: value with $/, and GitHub says it is available on github.com when the Actions runner is version 2.336.0 or newer. This is a small workflow change with a useful
CodeQL Action v4.37.4: Review Custom Tool Selection and Bundle Updates
A practical review checklist for CodeQL Action v4.37.4: verify repository-property tool selection, Advanced Setup precedence, the CodeQL 2.26.2 bundle, and least-privilege workflow evidence.
CodeQL 2.26.1: A Security Review Checklist for New Analysis Coverage
Review CodeQL 2.26.1 coverage changes, compare SARIF outputs, and retest affected security paths without overclaiming static-analysis results.
GitHub Actions Workflow Approval: A Security Review Checklist
Review GitHub Actions workflow approval holds, trigger scope, permissions, and evidence before allowing a potentially malicious run to execute.
GitHub-Hosted Runner Groups: A Security Review Checklist for Policy-Controlled CI
GitHub is adding more policy control around GitHub-hosted runners, including runner groups that can direct jobs to runners meeting an organization’s requirements and the ability to disable standard hosted runners. That is useful for platform teams, but a policy setting is not the same thing as a verified security boundary. The practical question is: what
How to Verify a Local Vulnerability Database Before Trusting Scan Results
Verify the scanner artifact, signed vulnerability database, input hash, and partial-coverage limits before trusting a local vulnerability scan.