Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

So this friend escaped from the ephemeral container VM into the build host which happened to have a private SSH on it that allowed it to connect to a bastion host to... go back to the build host and debug a failed build that should be self-contained inside the container VM which they already had access in the first place by the means of, you know, running a build on it? Interesting.

> probably against GitHub's ToS, but

Why would running code on a github action runner that's built to run code be against ToS?

If it was, I'm sure they'd ban the marketplace extensions that make it absolutely trivial to do this: https://github.com/marketplace/actions/debugging-with-ssh

could have just used https://github.com/mxschmitt/action-tmate

A few decades ago, it was also really common to smoke. Common != good, github actions isn't a true build tool, it's an arbitrary code runtime platform with a few triggers tied to your github.

It is and regardless a few other commenters saying or hinting it isn't...it is. An air gapped build machine wouldn't work for most software built today.

Strange. How do things like Nix work then? The nix builders are network isolated. Most (all?) Gentoo packages can also be built without network access. That seems like it should cover a decent proportion of modern software.

Instances where an air gapped build machine doesn't work are examples of developer laziness, not bothering to properly document dependencies.

Sounds like a problem with modern software build practices to me.

Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak.

The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.

People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit.

You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.