Security risks identified in GitHub Actions CI/CD pipelines require key controls

GitHub Actions CI/CD pipelines present supply chain risks because they combine code from multiple sources with credentials that can deploy to production. Three primary mechanisms drive this risk: using mutable tags for third-party actions, over-permissive default GITHUB_TOKEN permissions, and storing long-lived cloud credentials as secrets. Mitigations include pinning third-party actions to immutable commit SHAs, setting minimal workflow-level permissions, and using OIDC federation for cloud access instead of stored secrets. These controls, while creating some maintenance overhead, significantly reduce the potential for a single compromised dependency or malicious pull request to reach production systems.