openstatusHQ

GitHub Actions Supply-Chain Risk: 57% of Workflows in Our Scan Used Non-SHA Refs The 64.9% figure describes rule occurrences—not workflow prevalence. Here is what our scan of 279 GitHub Actions workflow files actually measured. The denominator changes the headline In a snapshot captured on October 31, 2026, we scanned 279 workflow files across nine open-source repositories. The rule GATE_RC_5_REF_MUTABLE flags each uses: reference that is not pinned to a full commit SHA. At least one such reference appeared in 159 of the 279 workflows: 57.0%. The finding appeared in seven of the nine repositories. So where does 64.9% come from? The scan recorded 607 non-SHA-pinned uses: occurrences out of 936 total rule occurrences across seven rule categories. That is 64.9% of the occurrences, not 64.9% of workflows. One workflow can contain multiple references and findings; those are different units. | Repository | Workflow files scanned | Non-SHA-pinned uses: occurrences | |---|---:|---:| | activepieces/activepieces | 38 | 149 | | calcom/cal.com | 50 | 89 | | documenso/documenso | 14 | 29 | | formbricks/formbricks | 34 | 0 | | hoppscotch/hoppscotch | 4 | 84 | | medusajs/medusa | 50 | 162 | | nocodb/nocodb | 11 | 22 | | openstatusHQ/openstatus | 20 | 72 | | supabase/supabase | 58 | 0 | | Total | 279 | 607 | Why a non-SHA reference matters A workflow can refer to an action by a version tag or branch, such as owner/action@v4 or owner/action@main. Those names are convenient, but they do not themselves identify an immutable commit. If a reference is moved—or its upstream repository is compromised—later workflow runs may retrieve different code without a change to the workflow file. GitHub recommends pinning actions to a full commit SHA and verifying that the SHA comes from the action’s upstream repository. A SHA pin makes the selected commit explicit; it does not prove that the commit is safe. Updates still need review. What this scan does not prove This result is an exposure signal, not evidence of a compromise. We did not measure whether individual tags were protected or immutable, whether any reference had actually moved, or what code executed at runtime. Nor is this nine-repository scan a representative estimate of all GitHub Actions workflows. A tenth candidate, twentyhq/twenty, could not be verified because its checkout was truncated. It was excluded from the denominator—not counted as clean. A practical next step Review every uses: reference, replace mutable names with verified full commit SHAs where appropriate, and make updates through a deliberate review process. Keep counts of affected workflow files separate from counts of individual references. For GitHub’s recommendations, see the secure-use guidance. For commit-pinned, evidence-backed repository audits, explore La Auditora. git-preflight-gate addresses a different concern—integrity checks before AI agents write to a repository; it is not an Actions workflow scanner. Its GitHub Marketplace listing is CI Authority Gate. --- The RC5-only evidence package (finding-level data, workflow manifest, census, method, and SHA-256 checksums) is available in the public release. It supports the RC5 counts above; it does not reproduce the 936-occurrence denominator across all seven rule categories.

网站或 API 出问题，用户会先发现吗？ OpenStatus 可监控服务可用性与响应时间，并提供公开状态页、故障通知。适合个人站长和小团队；公开状态页前检查暴露的信息。 openstatusHQ/openstatus #网站监控 #DevOps

My OpenStatus PR got merged 🎉 The sneaky part: an old verification link could still approve an expanded subscription - even after its token was rotated - if the request was already in flight. Fixed the race, added regression tests, learned a lot. openstatus#2859