Uploaded May 2026 | Updated September 2026, 22 hours ago
Providing computing power for projects of all shapes and sizes, GitHub Actions has become an industry-standard CI/CD platform for both open source and proprietary projects around the world. The extensive collection of reusable workflows makes it straightforward for developers to automate build and delivery pipelines. While this accelerates development and collaboration, it also introduces new risks: third-party pipelines that are not under your team's control now have access to deployment credentials, signing keys, and repository-wide permissions.
Join our Learning Lab with Erika Heidi, Staff DevRel Engineer at Chainguard, to learn how attackers exploit vulnerable GitHub Actions workflows, and how Chainguard can protect your CI/CD pipelines from these threats.
TIMESTAMPS
0:00 Introduction and agenda
5:31 Timeline of CI/CD software supply chain incidents
11:25 Open Source and CI/CD as the new target
12:47 2026: the year of AI-assisted attacks
15:16 Unpacking the Trivy Compromise
19:57 Secret exfiltration live demo
36:17 What could unfold from here
39:04 Strategies to mitigate risks
39:24 Repository inspection for insecure defaults
44:03 Minimize attack surface
48:48 Pull from trusted sources
52:21 Pin by digest
54:28 Use short lived tokens (ban PATs)
55:32 Use Chainguard Actions
58:55 Closing notes
About Chainguard
Founded by the industry's leading experts on open source software, security and cloud native development, we are on a mission to be the safe source for open source.
Where to find us:
Website: https://www.chainguard.dev/
Twitter: twitter.com/chainguard_dev
LinkedIn: linkedin.com/company/chainguard-dev
TikTok: tiktok.com/@chainguard_dev
Providing computing power for projects of all shapes and sizes, GitHub Actions has become an industry-standard CI/CD platform for both open source and proprietary projects around the world. The extensive collection of reusable workflows makes it straightforward for developers to automate build and delivery pipelines. While this accelerates development and collaboration, it also introduces new risks: third-party pipelines that are not under your team's control now have access to deployment credentials, signing keys, and repository-wide permissions.
Join our Learning Lab with Erika Heidi, Staff DevRel Engineer at Chainguard, to learn how attackers exploit vulnerable GitHub Actions workflows, and how Chainguard can protect your CI/CD pipelines from these threats.
TIMESTAMPS
0:00 Introduction and agenda
5:31 Timeline of CI/CD software supply chain incidents
11:25 Open Source and CI/CD as the new target
12:47 2026: the year of AI-assisted attacks
15:16 Unpacking the Trivy Compromise
19:57 Secret exfiltration live demo
36:17 What could unfold from here
39:04 Strategies to mitigate risks
39:24 Repository inspection for insecure defaults
44:03 Minimize attack surface
48:48 Pull from trusted sources
52:21 Pin by digest
54:28 Use short lived tokens (ban PATs)
55:32 Use Chainguard Actions
58:55 Closing notes
About Chainguard
Founded by the industry's leading experts on open source software, security and cloud native development, we are on a mission to be the safe source for open source.
Where to find us:
Website: https://www.chainguard.dev/
Twitter: twitter.com/chainguard_dev
LinkedIn: linkedin.com/company/chainguard-dev
TikTok: tiktok.com/@chainguard_dev
