01
Security
Stolen GitHub Accounts Used to Plant CI Secret Stealer in Repositories
Owners of repositories where the stealer ran should revoke tokens and rotate every secret the affected repository can read.
Owners of repositories where the stealer ran should revoke tokens and rotate every secret the affected repository can read.
The safety of each workflow now depends largely on how its author configures write access and custom jobs.
Users who clone repositories with submodules are exposed until they install Git 2.56.1 or a patched 2.50 to 2.55 release.
Pinned commits now run even when tags or branches move, but the lockfile does not vouch that those commits are safe.
Organisations running private repositories or GitHub Enterprise Server are not covered by GitHub's workflow hold, so they must check their own exposure.
GitHub made progress on moving production traffic and tightening failure handling, but recent incidents and a missed migration target show the work is not done.
Teams that invoked the affected actions may need to check whether workflow-accessible credentials were exposed.
Kelley defends prioritizing human mentorship over AI code and says moving to Codeberg restored reliable CI for Zig.