You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
### Detection and Mitigation of GitHub action smells
43
-
44
-
Contact: Eric Cornelissen
45
-
46
-
[GitHub Actions](https://docs.github.com/en/actions) is the continuous integration and continuous delivery (CI/CD) solution offered by GitHub.
47
-
It supports "[expressions](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/evaluate-expressions-in-workflows-and-actions)" which are parts of the workflow that are filled in at runtime.
48
-
The values may come from other parts of the CI/CD workflow or directly from the GitHub website.
49
-
A problem with this is that an attacker controlled value used in the wrong way can lead to compromise of the CI/CD workflow.
50
-
In this project we will look into automatically fixing such misconfigurations in GitHub Actions workflow definitions.
51
-
52
-
Related work:
53
-
54
-
Academic
55
-
56
-
1.[ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions](https://www.usenix.org/conference/usenixsecurity23/presentation/muralee)
57
-
1.[Automatic Security Assessment of GitHub Actions Workflows](https://dl.acm.org/doi/abs/10.1145/3560835.3564554)
58
-
1.[Characterizing the Security of Github CI Workflows](https://www.usenix.org/conference/usenixsecurity22/presentation/koishybayev)
59
-
1.[Ambush From All Sides: Understanding Security Threats in Open-Source Software CI/CD Pipelines](https://ieeexplore.ieee.org/document/10061526)
60
-
1.[Mitigating Security Issues in GitHub Actions](https://orbi.umons.ac.be/bitstream/20.500.12907/48447/1/Hassan2024-EnCyCriSSVM.pdf)
0 commit comments