Post

Sebastian Silbermann
@sebbie.dev

I personally would recommend reviewing actions/checkout with a custom ref input instead. actions/checkout is the way to escape trust boundaries. In pull_request_target events that's fork -> upstream. But in workflow_dispatch events actions/checkout allows running in protected GH environments.

James@43081j.com

most of these github actions driven breaches are because of pull_request_target. here's some tips of what to look for when reviewing your own workflows. worth noting - it is safe, and necessary, when used correctly 🧵

0 reposts0 likes

Sebastian Silbermann
@sebbie.dev

If you treat your default branch as something that went through PR review, you better make sure your workflow_dispatch doesn't do a checkout with a custom input.