3 ms·
> Every Monday a scheduled GitHub Action workflow triggers an automated pull request, which bumps our Rails version to the latest commit on the Rails main branc
by thih9 4y ago
> Every Monday a scheduled GitHub Action workflow triggers an automated pull request, which bumps our Rails version to the latest commit on the Rails main branch for that day.
So uploading code to a github repo makes github server execute it later on. I wonder if this would qualify for a bug bounty... /s
Edit: I guess not, since this is just a pull request and still requires approval before merging to main. I assume.
- georgyo 4y agoDon't work for GitHub, but it would not. First, it opens a Pull Request, not an automatic merge, so hopefully the code is reviewed before merge. To exploit this, you would first need to get malicious code merged into rails master which has many eyes, and then get passed more eyes when it gets reviewed by GitHub. Not impossible, but if you got your code merged into rails master, you have wiggled your way into many more environments than just GitHub.
- nicce 4y agoEven if it was just not pull-request, highly unlikely that it would qualify. We can assume that only trusted maintainers can put code into the Ruby main branch. Similarly, every build system depends on many many signed packages. It is not much different than that.