wtf( )unctionsystem design, drawn
← all problemsSupply ChainMedium

The version tag that moved

Every workflow references a shared build action by its version tag. The tag was reviewed, the action is popular, and thousands of repositories use it the same way.

Someone with write access repointed that tag at a different commit. Every workflow picked up the new code on its next run, and it printed the runner's secrets into build logs — which for public repositories are readable by anyone.

Reference the action in a way that can't be repointed underneath you.
Components — tap one, then tap a slot on the diagram
!A version tag was repointed at malicious code. Thousands of pipelines picked it up on their next run.

Outside every boundary: Reviewed commit, Attacker's commit (FAILED: now running), Your workflow, Version tag (the owner can repoint it; FAILED: repointed), an empty slot for the what you reference Connections: Your workflow calls what you reference (step 1) what you reference calls Reviewed commit — exactly this commit (step 2) Version tag publishes to Attacker's commit — moved here

Reviewed commit
Attacker's commitnow running
Your workflow
Version tagthe owner can repoint itrepointed