3 ms·

>The vast majority of repos should be able to run CI on pull requests with no privileges at all When there are no side effects and no in-container secrets and

by Groxx 3y ago

>The vast majority of repos should be able to run CI on pull requests with no privileges at all When there are no side effects and no in-container secrets and the hosting is free or reasonably limited to prevent abusers, ideally yes. Outside that, heck no, that'd be crazy. You're allowing randos to run arbitrary code on your budget. Locking it down until it's reviewed is like step 1, they can validate locally until then.

KptMarchewa 3y ago
GH actions are free on public repos.
- Groxx 3y ago
  Until someone tries to mine Bitcoin in yours, yeah
  - trevyn 3y ago
    Do you have a case study? My prior is that GitHub is pretty competent in understanding malicious PRs to open source repos, and wouldn’t penalize the repo owner without other evidence of wrongdoing.
guappa 3y ago
They are so difficult. I wanted to stop random people to run code on my repository… I don't have any secrets or write access or anything to exploit. Just to avoid burning quota. The issue is that now the pull requests don't get tested at all. I have to manually, locally, get all the commits, make a branch on the main repository with them, and then the actions run.
- growse 3y ago
  One approach might be to review manually, then label the pr and trigger the pr based off the label being added. Challenge there is that if the pr changes, it's a bit clunky to retrigger the CI (you have to remove, then re-add). I guess you could also do this with comments - can you trigger a workflow based on a specific comment being added from a specific user?
- Groxx 3y ago
  That just plain sounds Bad™, yeah. In the buildkite setup I interact with, I can at least just hit the "continue" button on the paused pipeline, regardless of any other GitHub state... which feels like table stakes to me.