3 ms·
The implied fix to the “unusable secure system” is forking the checkout action to your org and referencing it there.
by solumos 1y ago
The implied fix to the “unusable secure system” is forking the checkout action to your org and referencing it there.
- hiatus 1y agoThat's not a fix though is it? Git tools are already on the runner. You could checkout code from public repos using cli, and you could hardcode a token into the workflow if you wanted to access a private repo (assuming the malicious internal user doesn't have admin privileges to add a secret).