Re:GitHub “allows” unauthorized users “merging” PRs, bypass ...
by arriu on Thursday August 25, 2022 @04:41PM
(#32599676)
Could this cause a GitHub action to run?
[ Parent
| on HN ]
Re:GitHub “allows” unauthorized users “merging” PRs, bypass ...
by judge2020 on Thursday August 25, 2022 @04:43PM
(#32599708)
For the target repo, only on the pull_request event[0] would run; nothing is being `push`ed to the repo, so it doesn't allow something like pushing an actions script that exfiltrates secrets.
0: https://docs.github.com/en/actions/using-workflows/events-th...