Docker Hub OIDC for GitHub Actions: Retire Your Stored Access Tokens
Aug 8, 2026 · 8 min read · Docker Hub GitHub Actions OIDC CI/CD Security Supply Chain Security docker/login-action ·Docker Hub OIDC for GitHub Actions: Retire Your Stored Access Tokens If your CI pipeline pushes images to Docker Hub, there's a good chance a Personal Access Token (PAT) or Organization Access Token (OAT) is sitting in your GitHub repository secrets right now — valid for months, scoped broader than you'd like, and one …
Read MoreGitHub Actions Now Holds Suspicious Workflow Runs Before They Touch Your Secrets
Jul 31, 2026 · 8 min read · GitHub Actions CI/CD Security Supply Chain Security GITHUB_TOKEN Workflow Security ·GitHub Actions Now Holds Suspicious Workflow Runs Before They Touch Your Secrets On July 28, 2026, GitHub started automatically holding workflow runs it identifies as potentially malicious before they execute. If a run gets flagged, it sits in a pending state until a repository collaborator with write access reviews …
Read MoreGitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16
Jul 13, 2026 · 8 min read · GitHub Actions actions/checkout pull_request_target CI/CD Security Supply Chain Security ·GitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16 If your CI pipeline uses pull_request_target and checks out the pull request's head commit, actions/checkout@v7 will now refuse to do it. That's not a bug — it's GitHub closing one of the most common CI/CD attack patterns in the ecosystem, …
Read More