GitHub Actions hardening guidance pins actions by commit SHA

This article outlines essential technical controls for hardening GitHub Actions against outside supply chain threats, such as mutable tags and token permissions. The author examines real-world incidents from 2025 and 2026 and provides specific configuration patterns to prevent compromise. Key recommendations include pinning actions to full commit shas, restricting default token permissions, and avoiding untrusted code execution in pull request triggers. Open article →