CI/CD workflow file tampered to enable auto-trigger/unattended publish

Ibrahim Saud@tektrix

•updated 15 days ago•2•0•3

This rule detects modifications to GitHub Actions workflow configuration files (.yml or .yaml) located in the .github/workflows/ directory. Such modifications may indicate unauthorized tampering with CI/CD pipelines to facilitate persistent execution, credential theft, or supply chain attacks.