News for hackers. Stuff that matters.

A comment on We Executed a Critical Supply Chain Attack on PyTorch. Parent comment

Re:We Executed a Critical Supply Chain Attack on PyTorch by guappa on Monday January 15, 2024 @01:25AM (#38997953)
They are so difficult. I wanted to stop random people to run code on my repository… I don't have any secrets or write access or anything to exploit. Just to avoid burning quota.

The issue is that now the pull requests don't get tested at all. I have to manually, locally, get all the commits, make a branch on the main repository with them, and then the actions run.

[ Parent | on HN ]
Re:We Executed a Critical Supply Chain Attack on PyTorch by Groxx on Monday January 15, 2024 @02:01AM (#38998143)
That just plain sounds Bad™, yeah. In the buildkite setup I interact with, I can at least just hit the "continue" button on the paused pipeline, regardless of any other GitHub state... which feels like table stakes to me.
[ Parent | on HN ]
Re:We Executed a Critical Supply Chain Attack on PyTorch by growse on Thursday January 18, 2024 @08:38AM (#39041526)
One approach might be to review manually, then label the pr and trigger the pr based off the label being added.

Challenge there is that if the pr changes, it's a bit clunky to retrigger the CI (you have to remove, then re-add).

I guess you could also do this with comments - can you trigger a workflow based on a specific comment being added from a specific user?

[ Parent | on HN ]