News for hackers. Stuff that matters.
Re:GitHub “allows” unauthorized users “merging” PRs, bypass ... by jerrysievert on Thursday August 25, 2022 @03:00PM (#32598374)
GitHub ties "things" to a commit hash - which causes all sorts of interesting/unwanted behaviors.

    * create an action that only runs on branches with a specific pattern
    * create another action that only runs on branches with a different pattern
    * push a commit to a branch with the first pattern, create a PR
    * create a new branch with the second pattern
    * push the same commit on the second branch
    * watch things get confused on the PR that was originally created

There are no comments on this comment yet.