GitHub tightened two supply-chain defaults on 28 July: Dependabot alerts on malicious packages across more ecosystems, and Actions holds potentially malicious workflows for approval.
Good defaults handle the average case. The rest is yours. This checklist takes about an hour and is worth doing once properly.
Dependencies
- Confirm Dependabot alerts land somewhere a person reads, not an unmonitored channel
- Review the lockfile diff on every agent-authored pull request as a distinct step, not as part of reading the code
- Set a rule for new direct dependencies — a human names the package and says why, even if an agent installed it
Workflows and automation
- Make sure someone is empowered to approve or reject held workflows, or the new Actions default becomes a delivery block
- Pin third-party actions to a commit SHA rather than a tag
- Audit which automations can be triggered from a comment — GitHub added comment-triggered Copilot automations on 4 August, and that is a new path into your CI
Agent permissions
- Give cloud agents the narrowest token that lets them do their job; most only need to open a pull request, not merge one
- Scope any MCP server you connect to read-only where the distinction exists
- Keep required human approval on merge for anything touching auth, payments, or data deletion
The point of all this
Every prompt-to-app tool in this directory installs packages on your behalf, and so does every cloud coding agent. The volume of code nobody consciously chose has gone up sharply, and none of the tooling above assumes malice — it assumes volume.
Treat an agent that opens pull requests exactly as you would treat an outside contributor with commit access. That is what it is.