3 ms·
To clarify, this secret stealing is not an issue with GitHub-hosted runners, correct?
by trevyn 3y ago
To clarify, this secret stealing is not an issue with GitHub-hosted runners, correct?
- adnanthekhan 3y agoCorrect. For fork PR workflows on the pull_request trigger the GITHUB_TOKEN has read only permissions, so you can’t do anything with it. The key thing with a non-ephemeral runner is that (after obtaining persistence) you can grab the GITHUB_TOKEN from a subsequent non-fork PR build or a build on another trigger, which will have write permissions unless restricted by the repository maintainers.