4 ms·
Hopefully GH will apply this to Github Actions, which seem like an exploit vector just sitting there. GH Actions are: - complex enough to develop that third-p
by vosper 6y ago
Hopefully GH will apply this to Github Actions, which seem like an exploit vector just sitting there.
GH Actions are:
- complex enough to develop that third-party solutions are attractive, especially for simple-seeming tasks (I have just been through this)
- but yay there's a "marketplace" for actions!
- the code in the marketplace is the wild-west, but you'll find something that seems like it'll do what you want
- you'd better hope the code that was committed to be executed is actually the compiled source code (if, eg, it's based on the official Typescript example and committing some [com/trans]piled JS blob that is what actually gets executed)
- it has access to your code, maybe including write access
- or it could do damn near anything else
- Vinnl 6y agoAs far as I can see they also have access to your secrets. I really haven't gotten myself to use any non-GitHub-defined Actions yet, because I haven't been able to verify if that's actually safe.
- kageneko 6y agoThey don't have direct access. You need to assign the secret in your workflow file. Example: steps: - uses: actions/checkout@v2 - uses: sfdx-actions/setup-sfdx@v1 with: sfdx-auth-url: ${{ secrets.SFDX_AUTH_URL }} or steps: - uses: actions/checkout@v2 - name: Run deployment script env: HEROKU_API_TOKEN: ${{ secrets.HEROKU_API_TOKEN }} The first is for an Action, the second is for a normal workflow script.
- Vinnl 6y agoAh neat, so without the `with`, the Action does not have access to my secrets? That alleviates my concerns.