World C4: Pipeline Shields

The tj-actions story

You will learn: how moved tags leaked secrets from thousands of pipelines in March 2025.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

You use a popular action at @v45. You never touch that line. Can the code it runs still change?

Watch

Tap each point on the timeline.

Tap through a real attack. Thousands of pipelines ran bad code. Nobody had changed their own workflow file.

Watch

Tap the log line that still leaks a secret.

0 of 1 found

GitHub hides an exact secret as ***. The bad code changed each secret first: encoded twice. Changed text slips past. On public repos, anyone could read these logs. (This log is an example.)

Try it

Put the attack in order. First step at the top.

First step at the top. Put these in order. Use the arrows, or drag.

Pipelines run @v45 and get the bad commit
The bad code prints secrets into the log
They move the version tags to a bad commit
Anyone reads the public logs
The attacker gets write access to the action's repo

Try it

Tags follow whoever moves them. A full commit SHA cannot move.

Tap every line that ran the bad code on 14 March.

0 of 2 found

Predict

Your public repo ran it on 14 March. What do you do first?

Check

What should every team learn from this? Swipe each lesson.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Pin third-party actions to a full commit SHA

You did it!

You can now explain how moved tags leaked secrets from thousands of pipelines.

Go deeper (optional)

A few days before, reviewdog/action-setup was hacked too. Researchers think the two attacks are linked. Note: a SHA pin only helps if it points at a good commit. Pinning the bad commit itself would not help. Read the GitHub advisory and Semgrep’s write-up (links below).