GitHub Automatically Holds Suspicious Actions Runs, but Repository Owners Must Approve Them

GitHub is adding a human checkpoint before certain suspicious Actions workflows can run in public repositories. A repository collaborator with write access must review and approve the run through an authenticated GitHub web session before it can proceed. Attacker-controlled workflow execution may expose cloud credentials, package registry tokens or a repository’s GITHUB_TOKEN , according to security guidance from OWASP. Public repository owners should assign authorized reviewers, document the evidence required for approval and establish an escalation path before the first suspicious run is held. Read more: A separate incident shows what compromised repository access can enable after a stolen GitHub token exposed Grafana’s codebase.