[kata-dev] GitHub actions security recommendations

Christophe de Dinechin dinechin at redhat.com
Tue Jan 19 08:02:56 UTC 2021


I don't know if you are aware of the security recommendations in this paper: https://securitylab.github.com/research/github-actions-preventing-pwn-requests.

I thought this was interesting notably in the context of the discussion regarding unifying testing/CI and code repos. While it is true that a single repo makes it possible to commit a test along with the change, it also means a malicious PR now has a much larger attack surface, something that I personally was not aware of.

Food for thought.


More information about the kata-dev mailing list