Russ Cox @swtch.com · Mar 29 In my 2023 ACM talk, to illustrate how supply chain security is more than just build deps graphs, I showed a graph of the servers involved in building and serving Go releases. Has anyone done something like this but for GitHub Actions? We have examples now of attacks moving between actions.
46 likes 2 replies
?
Replies
the building space is about to get wild. the hardest part is knowing when to ship vs when to keep iterating and nobody is talking about it yet
For example, in 2025, a successful attack on the GitHub Action reviewdog/action-setup was used to infect the Action tj-actions/changed-files, with an ultimate target of coinbase/agentkit. www.wiz.io/blog/new-git...