A GitHub workflow is an automated job definition, usually in GitHub Actions, that runs when a repository event occurs, such as a push, pull request, or manual trigger. It can build code, run tests, publish artifacts, or deploy software on a runner, which is the machine or container that executes the job.
Workflows matter in cyber security because they often handle source code, secrets, tokens, logs, and release permissions. If an attacker can influence workflow inputs, they may trigger command injection, expose credentials, or alter a pipeline’s output. Defenders reduce this risk by using least-privilege tokens, separating trusted and untrusted triggers, validating inputs, pinning actions, and adding approval gates before deployment. In modern CI/CD systems, even AI coding tools become part of this trust boundary if they can read files, run commands, or modify workflow logic.