19 Jan
                
                    2021
                
            
            
                19 Jan
                
                '21
                
            
            
            
        
    
                12:02 a.m.
            
        Hello, I don't know if you are aware of the security recommendations in this paper: https://securitylab.github.com/research/github-actions-preventing-pwn-reques.... I thought this was interesting notably in the context of the discussion regarding unifying testing/CI and code repos. While it is true that a single repo makes it possible to commit a test along with the change, it also means a malicious PR now has a much larger attack surface, something that I personally was not aware of. Food for thought. Thanks, Christophe