3 ms·
If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the execut
by Too 3y ago
If the GitHub action only takes the source repo itself as input, you can review the state of the repo, including the .github/workflows to ensure that the executable was created consistently from given commit.
This assumes the actions are not downloading content from other places, which I’m not sure is easy to enforce given prevalence of package managers. Meaning workflows has to be reviewed manually for such.
- layer8 3y agoIf a non-technical end user installs malware, it doesn't help them that they could have inspected the source commit of said malware.
- charcircuit 3y ago1. Buy compromised github account 2. Create public repo with just an exe of malware and whatever is needed to setup the action 3. Download the signed exe 4. Delete the repo 5. Repeat It doesn't mean much.