News for hackers. Stuff that matters.

A comment on Codecov Bash Uploader compromised. Parent comment

Re:Codecov Bash Uploader compromised by goerz on Friday April 16, 2021 @12:13PM (#26835743)
Why doesn’t GitHub Actions limit the environment variables it exposes to jobs/steps? The codecov step doesn’t need my GitHub or PyPI tokens! Environment variables should be opt-in for every step in the pipeline: I should have to explicitly list every environment variable I want to expose. This leak is as much on GitHub as it is on Codecov
[ Parent | on HN ]
Re:Codecov Bash Uploader compromised by mhils on Friday April 16, 2021 @04:22PM (#26838652)
GitHub actually introduced "Environments" recently, which allow you to do what you are asking for. Lots of existing pipelines haven't migrated yet of course.

https://docs.github.com/en/actions/reference/environments

[ Parent | on HN ]
Re:Codecov Bash Uploader compromised by goerz on Saturday April 17, 2021 @10:03AM (#26844333)
Nice!
[ Parent | on HN ]
Re:Codecov Bash Uploader compromised by fishnchips on Sunday April 18, 2021 @02:43PM (#26855121)
GitHub Actions actually requires you to explicitly pass secrets to individual steps. If you're using GitHub Actions, what got leaked was the commit metadata, and the codecov token itself. Unless you manually passed the entire environment to the codecov step, that is.
[ Parent | on HN ]