ST-2026-102 · Runtimes & developer platforms
GitHub Actions automatically holds potentially malicious workflow runs for approval
GitHub now automatically stops certain workflow runs in public github.com repositories before execution when it identifies them as potentially malicious, pending authenticated approval by a write-access collaborator.
Previous state
Before GitHub added this protection, public github.com repositories did not receive this GitHub-applied pre-execution approval hold for workflow runs identified as potentially malicious.
Current state
GitHub Actions automatically holds certain workflow runs before they start when GitHub identifies them as potentially malicious. The run remains stopped until a repository collaborator with write access reviews and approves it through an authenticated web session, after which it continues normally.
Affected users
Who needs to care
Public repositories on github.com whose Actions workflow runs are identified by GitHub as potentially malicious, plus repository collaborators with write access who are responsible for reviewing those held runs.
Required response
What to do
No protection setup is required. When GitHub holds a run, a collaborator with write access must inspect it and submit approval through an authenticated web session before any job executes.
Evidence boundary
What the source does not prove
GitHub applies the protection automatically only to certain workflow runs in public repositories on github.com. The announcement does not publish the detection criteria, does not state a rollout deadline, and says GitHub Enterprise Server does not include this protection at this time.
Lifecycle history
Dated event sequence
- Potentially malicious workflow hold launched
GitHub began automatically holding certain flagged Actions workflow runs in public github.com repositories until authenticated approval by a write-access collaborator.
Evidence ledger
First-party sources
- 01GitHub — GitHub Actions holds potentially malicious workflows for approval
Official GitHub Changelog · 2026-07-28
Open official source ↗