DevOps Community Sponsored by Cloud Posse

SweetOps

<https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#attack-6-aquasecuritytrivy---evidence-cleared|https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation#attack-6-aquasecuritytrivy---evidence-cleared>

cc <@UB2EH889X> <@UB89GSWCF>  idk if you folks have evaluated your gha but worth double checking with something like openssf or stepsecurity and similar

Example

<https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard|https://scorecard.dev/viewer/?uri=github.com/ossf/scorecard>

<https://app.stepsecurity.io/secure-repo|https://app.stepsecurity.io/secure-repo>

<https://app.stepsecurity.io/secure-repo?repo=https://github.com/cloudposse/atmos|https://app.stepsecurity.io/secure-repo?repo=https://github.com/cloudposse/atmos>

Related <https://sweetops.slack.com/archives/CUJPCP1K6/p1772407908607229?thread_ts=1772407908.607229&amp;cid=CUJPCP1K6|https://sweetops.slack.com/archives/CUJPCP1K6/p1772407908607229?thread_ts=1772407908.607229&amp;cid=CUJPCP1K6>

Yeah, this was insane. We got rid of all `pull_request_target` a long time ago.

And we require manual workflow approval for all runs (from non-members)