Sebastian Silbermann on Mythryl: “If you treat your default branch as something that went through PR…”

I personally would recommend reviewing actions/checkout with a custom ref input instead. actions/checkout is the way to escape trust boundaries. In pull_request_target events that's fork -> upstream. But in workflow_dispatch events actions/checkout allows running in protected GH environments.

James@43081j.com

most of these github actions driven breaches are because of pull_request_target. here's some tips of what to look for when reviewing your own workflows. worth noting - it is safe, and necessary, when used correctly 🧵

Post