Use only trusted third-party Github actions from reputable sources

Using only trusted third-party Github actions from reputable sources is an important security practice that reduces the risk of vulnerabilities in the CI/CD pipeline.
Reputable sources include established Github action providers with a history of creating high-quality, secure actions. Organizations can verify the reputation of a third-party Github action by researching the provider, reviewing their Github action repositories, and checking for reported security issues.

Applies to

T0210 Poison AI coding-agent config or workspace
T0202 Inadequate CI/CD workflow permissions
T0198 Malicious Build Time Dependencies
T0203 Discover localized out-of-band deployments
T0122 Vulnerability in third-party CI/CD actions

References

None listed.