Hi Christophe, Thanks for the article, I got two points after check it. 1. As part of our automation we should not use "pull_request_target" trigger as will give the workflow write permissions. 2. This seems that this could be a problem even for multi repository model as we have actions both repos kata-containers and tests. Seems that we are OK based on what I quickly check on our repos, but seems to be easily to ignore that target and have some potential issue in the future. - Carlos
-----Original Message----- From: Christophe de Dinechin <dinechin@redhat.com> Sent: Tuesday, January 19, 2021 2:03 AM To: kata-dev@lists.katacontainers.io Subject: [kata-dev] GitHub actions security recommendations
Hello,
I don't know if you are aware of the security recommendations in this paper: https://securitylab.github.com/research/github-actions-preventing-pwn- requests.
I thought this was interesting notably in the context of the discussion regarding unifying testing/CI and code repos. While it is true that a single repo makes it possible to commit a test along with the change, it also means a malicious PR now has a much larger attack surface, something that I personally was not aware of.
Food for thought.
Thanks, Christophe
_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev