William Woodruff (1.3.6.1.4.1.55738)

@yossarian.net

442 Followers 65 Following

skeeting in accordance with the universal law. yossarian.net / blog.yossarian.net

Much of the world's open source lives on GitHub, and uses GitHub Actions to provide tasks ranging from routine testing to critical build and release processes. As such, the security of GitHub Actions (and the workflows and actions that users develop and consume) is paramount to the security of the world's software. But how secure is GitHub Actions, really? This talk will introduce GitHub Actions' internal building blocks and (mostly implicit) security model, and provide real world examples of security failures and surprising avenues of exploitation that recur in widely used actions and workflows. These examples will be motivated via zizmor , a Rust-based static analysis tool for GitHub Actions that can catch many of the most common (and severe) footguns that occur when writing workflows. Attendees will leave knowing more about GitHub Actions security and best practices for writing secure workflows, as well as how to use zizmor both locally and in Cl to detect potential security issues. No prior familiarity with GitHub Actions is necessary.
a bag of coffee labeled “DNS Reserve”
a picture of a restaurant in Copenhagen called “The Bronx”
a side of a car with “ich liebe dich” printed on it in cursive, which makes it look like “ich liebe dick”
a blurry image of a bottle of Gösser NaturRadler
taco shells and matzos next to each other in the “international foods” aisle