4 ms·
I have the similar concerns as you. I still use actions, but I am very careful about reading through the code of any actions I use. Your idea to use forked ver
by mjgs 6y ago
I have the similar concerns as you. I still use actions, but I am very careful about reading through the code of any actions I use.
Your idea to use forked versions of actions is interesting.
Another security concern I have with GitHub is that when you give permission for a 3rd party app on your repo, you have to give access across all repos in your account.
I’m really surprised it’s not possible to give access to a specific repo. It’s bizarre to me that it’s setup like this.
- prepend 6y agoGitHub’s security scopes are the closest that I’ve come to dropping them. When I create a token, I have to grant access to all repos or none. That’s crazy since I admin some stuff any token I have for work means it’s a risk to everything. Also, there’s no read-only scope for some admin functions. So to read private repo metadata for simple auditing purposes I have to grant access to edit them as well. That’s crazy. Same for repo access. The fact that I can’t create a read only token for a repo is annoying. I think this is a legacy from them not having a nuanced security model and it’s annoying. The only around this now is to create different user accounts and that’s annoying.
- mjgs 6y agoYeah the way token permissions are implemented totally baffles me every time. I never know if I’m creating a token for read or write or both.