GitHub Actions holds potentially malicious workflows for approval

GitHub Actions now automatically holds certain workflow runs for approval before execution when they are identified as potentially malicious. This protection targets supply chain attacks where compromised GitHub credentials are used to push malicious workflows that steal CI/CD credentials. No configuration is needed — GitHub applies it automatically to public repositories on github.com. A repository collaborator with write access must review and approve held workflows via an authenticated web session before they can run.

Source: https://github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.