Lesson 3.7: A poisoned GitHub Action and leaked CI secrets
CI pipelines run third-party code with access to deployment keys and tokens. On 14–15 March 2025 attackers changed the version tags of tj-actions/changed-files, an action used by tens of thousands of repositories, to point at malicious code that printed the runner's secrets into the job log, encoded twice in base64 (CVE-2025-30066). Every workflow that referenced the action by tag ran it; in public repositories, anyone could read the logs. In the lab you find Northwind's workflows that used it, the runs inside the window, the leaked value in a public log, and every other action still referenced by a movable tag.
17 min
You will learn to
- Explain why tag references to actions are risky
- Find workflows using a compromised action
- Select CI runs inside an exposure window
- Recognise and decode leaked secrets in logs
- Pin actions to full commit SHAs
Key terms
- GitHub Action
- A reusable step in a GitHub workflow, often maintained by a third party.
- Tag vs commit SHA
- A tag (v45) can be moved to another commit; a full SHA always means the same code.
- Runner
- The machine that executes a workflow job, with its secrets in memory.
- Secret masking
- CI replaces known secret values with *** in logs; encoding them defeats it.
- Exposure window
- The period during which the malicious version was served.
← Envelope encryption and key rotation · All lessons · Threat actors and their motives →