Zizmor
GitHub Actions Secrets: OIDC, Environments, SHA Pins
10 min readMost GitHub Actions secret leaks are not clever. A long-lived AWS key sits in repository secrets for three years, a pull_request_target workflow checks out a fork and runs its npm …