How 23,000 Repos Got Their Secrets Stolen Through Their Own CI/CD Pipeline

Been thinking about writing this one for a while. Supply chain attacks against CI/CD pipelines have been picking up pace over the past two years and the March 2025 tj-actions incident was the one that finally made me sit down and document everything properly. This is how I think about hardening GitHub Actions pipelines and what I actually do in practice. Original is on my blog but happy to have the conversation here too. On a regular Tuesday morning, your engineering team pushes code, the pipeli