[Changelog] GitHub Actions holds potentially malicious workflows for approval

[plengauer]

GitHub has announced that GitHub Actions will now hold potentially malicious workflows for approval before they can run, as described in the July 28, 2026 changelog post.

What changed

GitHub Actions has introduced an automatic hold mechanism for workflows that are deemed potentially malicious. Such workflows will be queued for manual approval before execution, adding a security layer to prevent supply chain attacks via workflow injection.

Relevance to this project

This project provides OpenTelemetry instrumentation that is injected into GitHub Actions workflows at the job and workflow level. The instrumentation works by:

• Injecting a first step in jobs via actions/instrument/job
• Wrapping workflows via actions/instrument/workflow
• Collecting telemetry by post-processing GitHub Actions run data via the API

If GitHub's security detection flags instrumented workflows as potentially malicious (e.g., due to dynamic script execution, environment variable injection, or shell aliasing patterns), it could silently delay or block instrumented CI runs.

What needs investigation / action

1. Test whether instrumented workflows are flagged: Run a test to confirm that workflows using plengauer/Thoth/actions/instrument/job or actions/instrument/workflow are not held for approval.
2. Review the detection criteria: Understand what patterns GitHub considers "potentially malicious" and check whether this project's injection patterns (e.g., setting PATH, exporting environment variables, using eval-like constructs, shell aliasing) could trigger the hold.
3. Monitor CI: Watch if CI runs start being unexpectedly delayed due to this new approval gate.
4. Update documentation: If there are known safe patterns users should use to avoid false positives, document them.

Affected areas

• actions/instrument/job/ — injects a step into every job
• actions/instrument/workflow/ — wraps the entire workflow
• Any user workflow that sources otel.sh or uses this project's actions

Generated by Monitor GitHub Changelog · sonnet46 45.7 AIC · ⌖ 5.67 AIC · ⊞ 5.2K · ◷

[github-actions]

Triage Analysis

This issue tracks GitHub's new automatic hold mechanism for potentially malicious workflows and its potential impact on Thoth's instrumentation.

Risk Assessment

Thoth's instrumentation likely uses patterns that could trigger GitHub's detection heuristics:

• Shell aliasing — otel.sh instruments via shell aliases, which may resemble dynamic code injection
• Environment variable injection — actions/instrument/job injects env vars into subsequent steps
• Dynamic script execution — wrapping mechanisms may use eval-like constructs or PATH manipulation

Suggested Investigation Steps

1. Check actions/instrument/job and actions/instrument/workflow for any patterns that match GitHub's heuristics (undisclosed, but likely: eval, dynamic env, injecting into $GITHUB_ENV/$GITHUB_PATH, curl-pipe-sh patterns)
2. Run a test workflow using the actions and observe whether it gets held for approval in a fork or new repo
3. Review the GitHub blog post criteria and cross-reference with src/usr/share/opentelemetry_shell/*.sh and actions/instrument/*/action.yml
4. Document safe usage patterns if any specific configurations are safer than others

Potential Solution

If flagged, the fix likely involves making the instrumentation more static/declarative rather than dynamic — e.g., avoiding runtime-generated shell code, or ensuring the injected step content is fully deterministic and visible in the workflow YAML. This may be a relatively small change but needs the investigation first.

@plengauer — happy to assign Copilot to investigate once we have more clarity on what specifically GitHub's detection looks for. Do you have access to a test environment where you can verify if current instrumented workflows trigger the hold?

Generated by Autotriage for #3881 · sonnet46 9.63 AIC · ⌖ 4.2 AIC · ⊞ 5.2K · ◷