Astral secures CI/CD with hash-pinned actions

Summary

Supply chain attacks via compromised actions or leaked org-level secrets now have measurable friction. Developers can replicate Astral's controls (zizmor audits, pinact automation, branch/tag protections) to reduce blast radius without sacrificing CI/CD velocity.

Why it matters

Supply chain attacks via compromised actions or leaked org-level secrets now have measurable friction. Developers can replicate Astral's controls (zizmor audits, pinact automation, branch/tag protections) to reduce blast radius without sacrificing CI/CD velocity.

Sources

1. 1.GitHub Actions has poor security defaults, and security compromises like those of Ultralytics, tj-actions, and Nx all began with well-trodden weaknesses like pwn requests
2. 2.We forbid many of GitHub's most dangerous and insecure triggers, such as pull_request_target and workflow_run, across our entire GitHub organization
3. 3.We require all actions to be pinned to specific commits (rather than tags or branches, which are mutable)
4. 4.we default to read-only permissions at the organization level, and we additionally start every workflow with permissions: {} and only broaden beyond that on a job-by-job basis
5. 5.we use deployment environments and environment-specific secrets. This allows us to further limit the blast radius of a potential compromise