💡 Post-MEGALODON Workflow File Integrity Monitoring & Org Credential Hygiene Standard

[github-actions[bot]]

Summary

Establish an org-wide standard for defending against the MEGALODON-class attack vector: infostealer-sourced credential theft leading to mass workflow file poisoning. Covers org-member credential hygiene requirements (MFA enforcement, short-lived PATs), workflow file change detection and alerting, CODEOWNERS enforcement for .github/workflows/, and suspicious commit author verification.

Market Signal

The MEGALODON_CI attack (May 18, 2026) injected 5,718 malicious workflow commits across 5,561 repos in a single 6-hour window — the largest known CI/CD supply chain attack to date. 33% of affected accounts were traced to infostealer-compromised machines. The attackers used forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot) and two payload variants: mass (SysDiag — triggers on every push/PR) and targeted (Optimize-Build — dormant workflow_dispatch backdoor). The attack exploited repos that lacked branch protection and CODEOWNERS on .github/workflows/.

Sources: MEGALODON analysis (The Hacker News), StepSecurity deep-dive, CSA Research Note, SecurityWeek

User Signal

The org has existing ideas around credential canaries (#1028 — detecting exfiltration FROM runners), agent trust boundaries (#974), and defense-in-depth (#339), but none address the upstream vector: org member credential hygiene preventing the initial compromise. The org manages multiple bot accounts and automation tokens (dependabot[bot], dependabot-automerge-petry app, Claude Code action tokens) that would be high-value targets. The push-protection.md standard covers secret scanning but not credential hygiene for org members themselves.

Technical Opportunity

The org's existing infrastructure maps directly to implementation:

1. compliance-audit.sh — extend to verify CODEOWNERS includes .github/workflows/ with security team routing in ALL repos
2. apply-repo-settings.sh — verify branch protection covers the default branch including workflow directories
3. GitHub org settings — verify SSO/MFA enforcement for all org members (audit via gh api /orgs/{org}/members --jq '.[] | .login' cross-referenced with MFA status)
4. New: Workflow change alerting — a lightweight GitHub webhook or Actions workflow that fires when .github/workflows/ files are added/modified/deleted, comparing the committer against an allowlist of known humans and authorized bots

The existing labels.sh and push-protection.sh provide patterns for fleet-wide enforcement scripts.

Assessment

Dimension	Score	Rationale
Feasibility	high	Extends existing compliance-audit and apply-repo-settings infrastructure. No new external dependencies.
Impact	high	Closes the gap between "prevent unauthorized access" (existing) and "detect compromised authorized access" (missing).
Urgency	high	MEGALODON demonstrated the attack is industrialized and repeatable. The org's automation tokens and bot accounts are high-value targets.

Adversarial Review

Strongest objection: The org already has branch protection, CODEOWNERS, and push protection. MEGALODON targeted repos WITHOUT these protections — the org's existing defenses should be sufficient.

Rebuttal: MEGALODON specifically used stolen AUTHORIZED credentials, bypassing protections that assume the committer is who they claim to be. Branch protection prevents unauthorized pushes but not pushes from a stolen authorized token. The defense gap is: (1) no real-time alerting when workflow files change — only post-hoc detection via weekly compliance audit, (2) no verification that .github/workflows/ is in CODEOWNERS for ALL repos, (3) no org-level credential hygiene requirements (PAT expiry, MFA verification, token scope minimization) beyond GitHub's defaults. This standard fills the gap between "prevent unauthorized access" and "detect compromised authorized access."

Suggested Next Step

Add a compliance-audit check verifying CODEOWNERS covers .github/workflows/ in every repo, then prototype a webhook-based workflow file change alerting mechanism for real-time detection of suspicious workflow additions.