GitHub Actions will hold potentially malicious workflows until a collaborator with write access approves them.

So, thanks to a helpful Github employee on StackOverflow, I learned that GHA has a couple of helpful "features" that were tripping me up: - The 'checkout@v2' action by default only does a minimal ...

Docker Hub OIDC connections for GitHub Actions replace stored personal access tokens with per-run credentials that expire when a workflow run ends, closing the last major CI/CD stored-credential gap.