eBPF monitors HTTPS write activity at the kernel level, so it can observe request verbs and paths without installing certificates in the runner. MITM SSL depends on self-signed certificates and can fail when certificate pinning is in place. For CI/CD visibility, eBPF is less intrusive and better suited to accurately infer the minimum GitHub permissions a job really needs.
Kernel-level HTTPS observation vs certificate interception
eBPF and MITM SSL both aim to make encrypted traffic visible, but they do so at very different points in the request path. eBPF observes activity inside the runner after the application has already formed the request, while MITM SSL inserts itself as a trusted intermediary and depends on certificate trust being accepted by the client. That difference drives the trade-off between visibility, fidelity, and operational fragility.
With eBPF, you are observing the system call or kernel networking path rather than terminating TLS in user space, so you can often recover request metadata such as verb and path without changing the trust relationship inside the job. MITM SSL, by contrast, is only effective when the runner accepts the interception certificate chain, which makes it much more intrusive and easier to break in hardened environments.
For teams trying to understand GitHub Actions behaviour, the practical distinction is whether you want passive inspection of what the job actually sent, or active decryption by inserting a new trust boundary. That distinction matters because the first approach preserves the normal execution environment, while the second can alter the way the workflow behaves.
Why MITM SSL is brittle in CI/CD analysis
MITM SSL analysis depends on the runner trusting the proxy certificate and on the application not defending itself with certificate pinning or similar validation. In GitHub Actions, that is a real limitation because many clients, SDKs, and package managers can reject interception, produce false negatives, or behave differently once the TLS chain has been altered.
eBPF avoids that failure mode because it does not need to impersonate the remote server or rewrite trust anchors on the runner. That makes it better suited to environments where you want repeatable measurements across many jobs, especially when you are trying to infer the minimum permissions a workflow truly needs from observed outbound calls.
NHI Lifecycle Management Guide is a useful companion when the goal is to connect observed activity back to permissions, rotation, and offboarding decisions. Top 10 NHI Issues also helps frame why over-privileged automation is a recurring problem in CI/CD pipelines. For incident-style examples in GitHub ecosystems, Reviewdog GitHub Action supply chain attack shows how exposed pipeline activity can become a credential problem.
What this means for GitHub Actions permission analysis
The main value of eBPF in this use case is not just packet visibility, it is permission inference. If you can see the actual HTTPS calls a workflow makes, you can compare them against the OAuth scopes, repository permissions, and token capabilities that were granted to the job. That is often a more reliable way to spot permission creep than reviewing the workflow file alone.
MITM SSL can still be useful in some controlled test setups, but its success depends on the exact client stack in the runner. eBPF is usually the better default when the objective is low-friction observability, because it is less likely to perturb the job or fail when TLS validation is strict.
W3C is a sensible reference point for the browser and transport-security model that underpins certificate trust and interception limits. NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant where you want to map observability, audit, and access-control requirements back to the controls governing job permissions and logging. NIST Cybersecurity Framework 2.0 is also useful for aligning this visibility work with broader governance, detect, and protect outcomes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | Access to CI jobs should be limited to the permissions actually observed and justified. |
| Recommendation — Restrict workflow and token permissions to the minimum access the job demonstrably needs. | ||
| NIST CSF 2.0 | PR.AC — Identity Management, Authentication, and Access Control | GitHub Actions analysis is used to validate and reduce workflow access. |
| DE.AE — Anomalies and Events | Kernel-level inspection helps identify unusual outbound request patterns during CI jobs. | |
| Recommendation — Align workflow permissions with verified job behaviour and least-privilege access. Monitor workflow network activity for anomalous calls that imply excessive permissions. | ||
| NIST SP 800-63 | Digital Identity Guidelines | TLS trust and credential assurance are central to the interception-versus-observation distinction. |
| Recommendation — Use strong authenticators and trusted channels so interception does not become part of normal validation. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets Sprawl | GitHub Actions visibility is often needed because CI jobs can expose or misuse secrets. |
| NHI-02 — Over-Privileged Non-Human Identities | Observed HTTPS calls are used to determine whether automation has more access than it uses. | |
| Recommendation — Inventory and reduce secrets exposed to workflow execution paths. Trim workflow permissions to the smallest scope consistent with observed calls. | ||
Practitioner Guidance
What to prioritise: Use eBPF when your main question is “what did this job actually do over HTTPS?” and reserve MITM SSL for narrow lab conditions where you control the client trust store and can tolerate breakage. If certificate pinning, strict validation, or opaque SDKs are involved, assume MITM will under-report activity or change behaviour.
What to verify: Check that the captured verbs, paths, and destinations are enough to explain why the workflow needs its current permissions. If the observed network calls are narrower than the token scopes, treat that as evidence for permission reduction rather than as a logging curiosity.
Practitioner takeaway: For GitHub Actions analysis, the best tool is the one that preserves the job’s normal trust model while still giving you enough evidence to justify least-privilege permissions.
Related resources from NHI Mgmt Group
- What is the difference between GitHub Enterprise Cloud with data residency and GitHub Enterprise Server for code analysis governance?
- What is the difference between GitHub app access and shadow integrations using API keys or SSH keys?
- What is the difference between using a high-level pipeline and building directly around lower-level model calls?
- What is the difference between pinning a GitHub Action to a commit SHA and using a moving version tag?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
