5 ms·

I believe CI on pull requests runs without the secrets, to avoid precisely that issue.

• amscanne 6y ago
  Yes, the problem is that GitHub did not seem to consider that “malicious input” can include any content that is provided and parsed in some way. Unfortunately, all of stdout is parsed, and often includes things like issue titles, descriptions, commit messages, etc.