Open Stack

Hi Christophe, 

Thanks for the article, I got two points after check it.

1. As part of our automation we should not use   "pull_request_target" trigger as will give the workflow write permissions.
2. This seems that this could be a problem even for multi repository model as we have actions both repos kata-containers and tests.

Seems that we are OK based on what I quickly check on our repos, but seems to be easily to ignore that target and have some potential issue in the future.

-
Carlos


> -----Original Message-----
> From: Christophe de Dinechin <dinechin at redhat.com>
> Sent: Tuesday, January 19, 2021 2:03 AM
> To: kata-dev at lists.katacontainers.io
> Subject: [kata-dev] GitHub actions security recommendations
> 
> Hello,
> 
> 
> I don't know if you are aware of the security recommendations in this paper:
> https://securitylab.github.com/research/github-actions-preventing-pwn-
> requests.
> 
> I thought this was interesting notably in the context of the discussion
> regarding unifying testing/CI and code repos. While it is true that a single
> repo makes it possible to commit a test along with the change, it also means
> a malicious PR now has a much larger attack surface, something that I
> personally was not aware of.
> 
> Food for thought.
> 
> 
> Thanks,
> Christophe
> 
> 
> _______________________________________________
> kata-dev mailing list
> kata-dev at lists.katacontainers.io
> http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev