How We Eliminated Long-Lived CI Secrets Across 70+ Repos
Supply chain attacks on CI/CD pipelines are accelerating. A growing pattern involves attackers compromising popular GitHub Actions through tag poisoning — rewriting trusted version tags to point to malicious code that harvests environment variables, cloud credentials, and API tokens from runner environments. The stolen credentials are then exfiltrated to attacker-controlled infrastructure, often before anyone notices.
For every engineering organization, the question is no longer if your CI pipeline will encounter a compromised dependency, but what is exposed when it does.
At Pulumi, we asked ourselves that question and decided the answer should be “nothing useful.” Here’s how we got there.
