Auditing GitHub Actions for Leaked Secrets: OIDC, Least-Privilege PATs, and Audit-Log Tripwires

A practical audit playbook for GitHub Actions secret exposure, covering OIDC trust policies, least-privilege PATs, secret scanning, and audit-log tripwires in the wake of the GhostAction campaign that compromised 500+ accounts to steal cloud and AI API credentials.