6 ms·
Note that some Actions run with lower permission and cannot access GitHub Secrets. For example, actions triggered by Dependabot PRs cannot access secrets. This
by joshuanapoli 5y ago
Note that some Actions run with lower permission and cannot access GitHub Secrets. For example, actions triggered by Dependabot PRs cannot access secrets. This would normally prevent untrusted updates from testing/deploying on your AWS Account. Maybe federation would bypass these protections that depend on the identity triggering the action.
- Deathmax 5y agoThere's a lack of documentation since this isn't officially released yet, but my assumption is that you need write permissions to id-token in order to generate a JWT. As forked repos can at most get read access[1], presumably that would prevent a malicious fork job from generating the JWT. [1]: https://docs.github.com/en/actions/reference/authentication-in-a-workflow#permissions-for-the-github_token https://docs.github.com/en/actions/reference/authentication-...
- chrisrpatterson 5y agoYes a malicious fork will NOT be able to get a JWT just like they are not able to get any other secrets or privledges to the repo.
- jffry 5y agoI was going to ask for a source, but I saw you've commented in the past that you're the GitHub Actions product manager. This looks like a great feature to help keep long-lived AWS secrets out of my builds entirely.