Re:We Executed a Critical Supply Chain Attack on PyTorch
by trevyn on Sunday January 14, 2024 @06:23PM
(#38995503)
To clarify, this secret stealing is not an issue with GitHub-hosted runners, correct?
[ Parent
| on HN ]
Re:We Executed a Critical Supply Chain Attack on PyTorch
by adnanthekhan on Sunday January 14, 2024 @06:43PM
(#38995662)
Correct. For fork PR workflows on the pull_request trigger the GITHUB_TOKEN has read only permissions, so you can’t do anything with it.
The key thing with a non-ephemeral runner is that (after obtaining persistence) you can grab the GITHUB_TOKEN from a subsequent non-fork PR build or a build on another trigger, which will have write permissions unless restricted by the repository maintainers.