4 ms·
The action in question is not in the repository; it's retrieved at runner execution time. I think that's an important distinction.
by woodruffw 1y ago
The action in question is not in the repository; it's retrieved at runner execution time. I think that's an important distinction.
- lixtra 1y agoIt’s like putting curl -sSL https://example.com/install.sh https://example.com/install.sh | sh In your action. For sure happens.
- woodruffw 1y agoYes; I would also consider that a bad idea. Two wrongs don't make a right (and a different wrong doesn't justify a broken policy elsewhere).
- masklinn 1y agoBeing able to filter or disable network access (aside from what github requires on their side to interact with actions) would definitely be useful, but AFAIK that's only an option for self-hosted runners and enterprise accounts.
- woodruffw 1y agoYep, I agree completely. It's unfortunate that self-hosted runners are otherwise so difficult to secure, since controlled ingress/egress is otherwise an extremely strong motivation for using them.