TJ Actions Compromise: Execution Authority and Log Disclosure

Incident Overview (Without Journalism)

Tier A (confirmed): During March 14–15, 2025, changed-files release tags were redirected to malicious code that extracted runner secrets into workflow logs. The maintainer identifies version 46.0.0 as patched. Maintainer advisory.

Tier A (confirmed): StepSecurity reports confirmation at 17:00 UTC March 14, repository removal at 14:00 UTC March 15, and restoration at 22:00 UTC. These are investigator milestones, not a measured exposure interval for every consumer. Investigation.

Tier C (unknown): Organization-specific executions, credential reuse, and downstream losses require private telemetry. This is a retrospective architectural analysis; the publication date is not the incident date.

Tier B (inferred), bounded assumption: the isolation model applies to jobs that can execute third-party code; release-key exposure is conditional on credentials being reachable in that execution context.

Failure Surface Mapping

Define S = {C, N, K, I, O}: control plane, network layer, key lifecycle, identity boundary, and operational orchestration. Tier B (inferred): the dominant mechanism is CI/CD privilege leakage through executable dependency admission and shared credential access.

| Layer | Failure classification and boundary | | --- | --- | | C | Byzantine dependency reference; external release authority influences local execution | | N | Payload retrieval and log transport; no network outage is required | | K | Credential disclosure makes revocation necessary; rotation completeness is unknown | | I | Action execution reaches authority beyond file comparison | | O | Omission of admission/isolation controls permits propagation; detection timing extends exposure |

Crash failure is not necessary in this model. Byzantine describes malicious component behavior, not evidence that the platform consensus was compromised.

Formal Failure Modeling

Tier B (inferred): let S_t = (E_t, A_t, K_t, L_t) represent admitted executable digests, approved digests, accessible credentials, and log contents. T(S_t) resolves dependencies, executes code, and persists output. R(E_t) is credential reachability; K_release is the set of release credentials.

I(S_t):\quad E_t \subseteq A_t \quad\land\quad R(E_t)\cap K_{\mathrm{release}}=\varnothing

The proposed invariant requires approved executable content and no release-key reachability from analysis code. A moved tag can admit an unapproved digest; shared execution authority can violate the second clause. No assertion is made that every affected consumer held release keys. Admission must reject unknown digests before execution. Approval must cover transitive code and runtime downloads; pinning a wrapper alone is insufficient.

Adversarial Exploitation Model

Tier B (inferred): A_supply_chain changes upstream executable content; A_passive reads accessible logs; A_active uses a still-valid exposed credential; A_internal abuses existing log or runner access; A_economic seeks value from deployment or artifact authority. Only the supply-chain and disclosure mechanics are incident evidence; other classes are conditional extensions.

X = \Delta t \times W \times P_s

Here Δt is time from first exposure until effective credential invalidation, W counts reachable trust domains, and P_s is a locally normalized privilege score. X is a prioritization index, not a breach probability or monetary loss estimate. Compare it only under the same scoring scheme. Reduce invalidation latency first for credentials that cross production boundaries. Missing detection timestamps require an interval, not a fabricated point estimate.

Root Architectural Fragility

Tier B (inferred): the structural weakness is trust compression: a low-level comparison utility inherits the execution context of a credential-bearing job. Version labels express selection intent but do not establish immutable reviewed content. Logs create a second boundary, from transient execution to retained, potentially broad readership.

GitHub recommends full-length commit pins and least-privilege tokens. These controls reduce distinct risks; neither proves the selected code benign. Platform guidance. A pinned malicious digest remains malicious. A later step in the same compromised runner is not an independent release boundary.

Code-Level Reconstruction

Tier B (inferred): the vulnerable flow is mutable reference -> privileged execution -> credential access -> retained output. The following is a proposed admission and promotion design, not recovered incident source code. Policy functions must fail closed and run under an administrator independent of the submitted workflow.

# Policy pseudocode; enforcement lives outside the workflow checkout.
admit(job, policy):
    closure = resolve_transitive_code(job, network_fetches="deny")
    require closure.complete
    require every_digest(closure) in policy.reviewed_digests
    require no_digest(closure) in policy.revoked_digests
    require job.runner.is_ephemeral and job.runner.has_no_host_credentials
    require job.permissions <= policy.analysis_permissions
    require job.release_secrets == empty
    require job.oidc_token_minting == disabled
    return isolated_run(job, timeout=policy.max_runtime,
                        egress=policy.analysis_allowlist)

promote(artifact, evidence, approval):
    require verify_digest_and_provenance(artifact, evidence)
    require evidence.builder in policy.release_builders
    require approval.binds(artifact.digest, policy.version)
    # A signature alone does not establish that a build was trustworthy.
    require independent_release_checks(artifact)
    return isolated_deploy(artifact, credential_ttl=policy.release_ttl)

The analysis runner must not execute deployment code after credentials are issued. Artifact contents remain untrusted until release checks pass. Reproducibility comparisons need independent builders and a defined toolchain; matching outputs alone do not establish source safety.

Operational Impact Analysis

Tier B (inferred): define a node as a distinct runner-job execution within a fixed review window, not a repository installation.

B = \frac{\text{affected\_nodes}}{\text{total\_nodes}}

Count executions of the malicious digest in the numerator and all in-scope executions in the denominator. Tier C (unknown): neither population is available here; no numeric B is justified. Adoption counts cannot substitute for executed exposure.

Credential exposure is a separate inventory keyed by credential identity, validity interval, and resource scope. Latency and throughput effects depend on suspension and rebuild policy, not on the disclosure alone. For capacity planning, backlog Q drains in Q/(μ−λ) only if post-recovery service rate μ exceeds arrival rate λ; otherwise restrict admission. Financial loss is unresolved.

Enterprise Translation Layer

Tier B (inferred), proposed decisions:

CTO: require a documented boundary between analysis and deployment; block release when executable provenance is unresolved.
CISO: inventory credentials reachable from affected runs, revoke them, and verify invalidation through issuer-side evidence. Log removal cannot invalidate copied secrets.
DevSecOps: enforce digest policy outside repository control, rebuild on clean runners, and measure exposure-to-revocation latency.
Board: require evidence of containment coverage and explicit acceptance of unresolved credential scope before restoring high-impact release authority.

STIGNING Hardening Model

Tier B (inferred), proposed controls: isolate policy administration from workflow maintainers; separate analysis credentials from deployment identities; use two independent approvers for policy exceptions and high-impact promotions. This approval quorum is an organizational control, not Byzantine consensus.

External action -> digest review -> admission policy
                                      |
                                      v
                            ephemeral analysis runner
                            no release credentials
                                      |
                              untrusted artifact
                                      v
                    provenance + independent release checks
                                      |
                             protected approval
                                      v
                         isolated deployment identity

Set a zero-tolerance admission threshold for unreviewed executable digests and release credentials in analysis jobs. Restrict outbound endpoints, but treat the authorized log channel as a disclosure path. Monitor resolved digests, process behavior, token issuance, and log access without recording raw secrets.

Define a per-tenant concurrency ceiling c from clean-runner capacity and cap queued work; overflow must reject or defer before credential issuance. Set a measured revocation SLO per issuer, rather than assuming a universal deadline. Use short-lived deployment identities with repository, environment, and audience constraints.

Rollback must restore a reviewed workflow, runner image, and policy snapshot together. Never restore revoked credentials or a digest on the compromise denylist. Preserve restricted forensic evidence before removing exposed logs; verify required migrations before rolling application state backward.

Strategic Implication

Tier B (inferred): primary type: governance failure. This classification concerns executable admission and credential authority, not attribution of organizational negligence. The Infrastructure Doctrine lens treats build dependencies as delegated execution privileges.

Over a 5–10 year planning horizon, retain artifact-to-source provenance, dependency review records, policy versions, and revocation evidence across tool migrations. This is a design horizon, not a forecast of attack frequency. Primary institutional surface: Mission-Critical DevSecOps. Capability lines: Reproducible and signed build pipelines; Policy-as-code enforcement; Immutable rollout and rollback control.

References

Conclusion

The control objective is to prevent dependency compromise from becoming release authority or durable credential disclosure. Tier A establishes the historical mechanism; Tier B specifies conditional controls; Tier C prevents unsupported exposure estimates. Recovery is complete only when executable provenance, credential invalidation, and release separation are evidenced.

STIGNING Infrastructure Risk Commentary Series
Engineering Under Adversarial Conditions