1. Branches: names matching ^ci-sync-[0-9a-z]{6}$ whose only change adds .github/workflows/sync-check.yml with commit message ci: sync config. The commit is unsigned and authored as the token owner.
2. Audit log: workflow runs on ci-sync-* branches deleted within about a minute of finishing, and any request with user agent gheist. Also watch for many repos cloned by one token minutes before the branch appears.
3. No GitHub logs? Use the cloud: if workflows use OIDC, search AWS CloudTrail (or GCP/Azure equivalents) for role assumptions or token exchanges whose subject contains ci-sync-. That proves Actions ran on an attacker branch.
4. Self-hosted runners: files .gdmp_pat, .gdmp_patg, .gdmp_sweep and the string gdmp-pivot in job logs. If found, treat the host and its instance role as compromised.
5. Workflow content: toJSON(secrets) }}' | base32 -w 120, and from Oct 19 the separator output LAFA====. Workflow blob SHAs include f3da2b8b357dcda02fd455d314be2a95007516a6 (plain) and d09535857a741bbb976bdc084a9a021713133291 (timeout variant).

Harden: require reviewers on environments that hold production secrets, scope OIDC trust to protected branches or environments, swap personal access tokens for GitHub Apps or short-lived fine-grained tokens, and run self-hosted runners as ephemeral hosts without the Docker socket or open metadata access. Don't approve held sync-check runs.