{"thread":{"id":"55524","subject":"Random GitHub Actions added to git/git???","startedAt":"2021-04-20T00:29:40Z","lastAt":"2021-04-21T23:05:15Z","messageCount":9,"participants":["Junio C Hamano","Taylor Blau","Bagas Sanjaya","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"422358","messageId":"xmqqmttt7q8f.fsf@gitster.g","threadId":"55524","inReplyTo":null,"subject":"Random GitHub Actions added to git/git???","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-04-20T00:29:36Z","receivedAt":"2021-04-20T00:29:40Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"This is only of interest to those who interact with the mirror of\nthe public repository at GitHub, but anyway.\n\nI was browsing https://github.com/git/git/actions and noticed that\nthere are many \"workflows\", even though what we have in our source\ntree in .github/workflows/ define only two of them (which I consider\n\"officially sanctioned ones\").\n\nI suspect that these other ones come from \"pull requests\" random\npeople threw at us that never hit our tree, with changes to the\n.github/workflows/ directory in these PR.\n\nI find them quite distracting.\n\nIs this something the hosting site (GitHub) considers normal and\nhelpful to the projects they host? Is there an easy knob to disable\nthose other than what we have in our tree?\n\nThanks.\n"},{"id":"422359","messageId":"YH4jPMPrLA+a85RH@nand.local","threadId":"55524","inReplyTo":"xmqqmttt7q8f.fsf@gitster.g","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Taylor Blau","fromEmail":"me@ttaylorr.com","sentAt":"2021-04-20T00:41:32Z","receivedAt":"2021-04-20T00:41:36Z","isPatch":false,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"On Mon, Apr 19, 2021 at 05:29:36PM -0700, Junio C Hamano wrote:\n> I suspect that these other ones come from \"pull requests\" random\n> people threw at us that never hit our tree, with changes to the\n> .github/workflows/ directory in these PR.\n>\n> I find them quite distracting.\n\nThat's what I'd expect, too, but I'm not sure. I asked the people who\nwould know, and I'll reply back here once I have an answer.\n\n> Thanks.\n\nThanks,\nTaylor\n"},{"id":"422378","messageId":"e4ed4046-6aa0-608f-896e-1c70715b81f3@gmail.com","threadId":"55524","inReplyTo":"xmqqmttt7q8f.fsf@gitster.g","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Bagas Sanjaya","fromEmail":"bagasdotme@gmail.com","sentAt":"2021-04-20T09:48:17Z","receivedAt":"2021-04-20T09:48:24Z","isPatch":false,"sender":{"key":"bagasdotme@gmail.com","avatar":"https://avatars.githubusercontent.com/u/40219486?v=4"},"body":"On 20/04/21 07.29, Junio C Hamano wrote:\n> I was browsing https://github.com/git/git/actions and noticed that\n> there are many \"workflows\", even though what we have in our source\n> tree in .github/workflows/ define only two of them (which I consider\n> \"officially sanctioned ones\").\n> \n> I suspect that these other ones come from \"pull requests\" random\n> people threw at us that never hit our tree, with changes to the\n> .github/workflows/ directory in these PR.\n\nThey are Actions jobs triggered by GitGitGadget PRs. For example,\njob [1] corresponds to patchset [2].\n\n[1]: https://github.com/git/git/actions/runs/763138085\n[2]: https://lore.kernel.org/git/pull.847.v7.git.git.1618832276.gitgitgadget@gmail.com/\n\n-- \nAn old man doll... just what I always wanted! - Clara\n"},{"id":"422444","messageId":"nycvar.QRO.7.76.6.2104201748400.54@tvgsbejvaqbjf.bet","threadId":"55524","inReplyTo":"xmqqmttt7q8f.fsf@gitster.g","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2021-04-20T15:51:11Z","receivedAt":"2021-04-20T15:51:29Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Junio,\n\nOn Mon, 19 Apr 2021, Junio C Hamano wrote:\n\n> I was browsing https://github.com/git/git/actions and noticed that\n> there are many \"workflows\", even though what we have in our source\n> tree in .github/workflows/ define only two of them (which I consider\n> \"officially sanctioned ones\").\n\nIf you are referring to the \"Codacy Security Scan\" things and alike, I\nsaw them, too, and I think it was a single contributor who opened PRs\nadding those workflows.\n\nIf you click on one of them (such as above-mentioned \"Codacy Security\nScan\"), you will see that \"This workflow run has been marked as\ndisruptive\" (see for yourself at\nhttps://github.com/git/git/actions/workflows/codacy-analysis.yml).\n\nIt is a bit sad that those are still shown at all, but I think it's just a\nmatter of time until they vanish.\n\nCiao,\nDscho\n"},{"id":"422446","messageId":"nycvar.QRO.7.76.6.2104201751200.54@tvgsbejvaqbjf.bet","threadId":"55524","inReplyTo":"e4ed4046-6aa0-608f-896e-1c70715b81f3@gmail.com","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2021-04-20T15:55:05Z","receivedAt":"2021-04-20T15:55:19Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Bagas,\n\nOn Tue, 20 Apr 2021, Bagas Sanjaya wrote:\n\n> On 20/04/21 07.29, Junio C Hamano wrote:\n> > I was browsing https://github.com/git/git/actions and noticed that\n> > there are many \"workflows\", even though what we have in our source\n> > tree in .github/workflows/ define only two of them (which I consider\n> > \"officially sanctioned ones\").\n> >\n> > I suspect that these other ones come from \"pull requests\" random\n> > people threw at us that never hit our tree, with changes to the\n> > .github/workflows/ directory in these PR.\n>\n> They are Actions jobs triggered by GitGitGadget PRs.\n\nNo, they are not. From GitGitGadget's own home page at\nhttps://gitgitgadget.github.io/:\n\n\n\tBut... what is GitGitGadget?\n\n\tGitGitGadget itself is a GitHub App that is backed by an Azure\n\tFunction written in pure Javascript which in turn triggers an\n\tAzure Pipeline written in Typescript (which is really easy to\n\tunderstand and write for everybody who knows even just a little\n\tJavascript), maintained at\n\thttps://github.com/gitgitgadget/gitgitgadget.\n\nIn other words, GitGitGadget uses Azure Pipelines, not GitHub Actions.\n\n> For example, job [1] corresponds to patchset [2].\n>\n> [1]: https://github.com/git/git/actions/runs/763138085\n\nThis has nothing to do with GitGitGadget, it is the regular\n`check-whitespace.yml` check from our very own\n`.github/workflows/check-whitespace.yml`.\n\nCiao,\nJohannes\n\n> [2]:\n> https://lore.kernel.org/git/pull.847.v7.git.git.1618832276.gitgitgadget@gmail.com/\n\n"},{"id":"422448","messageId":"YH7/62atD652Txnl@nand.local","threadId":"55524","inReplyTo":"YH4jPMPrLA+a85RH@nand.local","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Taylor Blau","fromEmail":"me@ttaylorr.com","sentAt":"2021-04-20T16:23:07Z","receivedAt":"2021-04-20T16:23:16Z","isPatch":false,"sender":{"key":"me@ttaylorr.com","avatar":"https://avatars.githubusercontent.com/u/301000140?v=4"},"body":"On Mon, Apr 19, 2021 at 08:41:32PM -0400, Taylor Blau wrote:\n> On Mon, Apr 19, 2021 at 05:29:36PM -0700, Junio C Hamano wrote:\n> > I suspect that these other ones come from \"pull requests\" random\n> > people threw at us that never hit our tree, with changes to the\n> > .github/workflows/ directory in these PR.\n> >\n> > I find them quite distracting.\n>\n> That's what I'd expect, too, but I'm not sure. I asked the people who\n> would know, and I'll reply back here once I have an answer.\n\nThe answer is that every workflow that was run in either (a) any branch\nof a repository, or (b) in any pull requests against that repository\nwill show up in that list.\n\nAs Dscho noted lower in the thread, all of the ones on git/git are spam.\nFrom my conversation with the Actions folk, it sounds like we don't hide\nthese currently, but they are planning on doing it soon. So they will\ndisappear eventually, but not before it's implemented.\n\nHope that helps.\n\nThanks,\nTaylor\n"},{"id":"422470","messageId":"xmqqzgxs4sed.fsf@gitster.g","threadId":"55524","inReplyTo":"nycvar.QRO.7.76.6.2104201748400.54@tvgsbejvaqbjf.bet","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-04-20T20:23:22Z","receivedAt":"2021-04-20T20:23:28Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> If you click on one of them (such as above-mentioned \"Codacy Security\n> Scan\"), you will see that \"This workflow run has been marked as\n> disruptive\" (see for yourself at\n> https://github.com/git/git/actions/workflows/codacy-analysis.yml).\n\nYes, I was the one who \"manually disabled\" some of them. I did not\nfind how to mark them \"as disruptive\", though.\n\nHow well are our refs protected from these random \"Actions\"? Can\nsomebody spam us with a pull request with a new \"workflow\" that\nadvances one of our integration branches ;-)?\n\n\n"},{"id":"422578","messageId":"nycvar.QRO.7.76.6.2104211437040.54@tvgsbejvaqbjf.bet","threadId":"55524","inReplyTo":"xmqqzgxs4sed.fsf@gitster.g","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2021-04-21T12:38:06Z","receivedAt":"2021-04-21T12:38:34Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Junio,\n\nOn Tue, 20 Apr 2021, Junio C Hamano wrote:\n\n> Johannes Schindelin writes:\n>\n> > If you click on one of them (such as above-mentioned \"Codacy Security\n> > Scan\"), you will see that \"This workflow run has been marked as\n> > disruptive\" (see for yourself at\n> > https://github.com/git/git/actions/workflows/codacy-analysis.yml).\n>\n> Yes, I was the one who \"manually disabled\" some of them. I did not\n> find how to mark them \"as disruptive\", though.\n>\n> How well are our refs protected from these random \"Actions\"? Can\n> somebody spam us with a pull request with a new \"workflow\" that\n> advances one of our integration branches ;-)?\n\nThe GITHUB_TOKEN that is used by the GitHub workflows is generated in two\nways, depending whether a PR originated from the same repository or from a\nfork. If it came from a fork, the token has only read permissions.\n\nSo I'd say we're still safe.\n\nCiao,\nDscho\n"},{"id":"422639","messageId":"xmqqlf9bxmqj.fsf@gitster.g","threadId":"55524","inReplyTo":"nycvar.QRO.7.76.6.2104211437040.54@tvgsbejvaqbjf.bet","subject":"Re: Random GitHub Actions added to git/git???","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-04-21T23:05:08Z","receivedAt":"2021-04-21T23:05:15Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> On Tue, 20 Apr 2021, Junio C Hamano wrote:\n>\n>> How well are our refs protected from these random \"Actions\"? Can\n>> somebody spam us with a pull request with a new \"workflow\" that\n>> advances one of our integration branches ;-)?\n>\n> The GITHUB_TOKEN that is used by the GitHub workflows is generated in two\n> ways, depending whether a PR originated from the same repository or from a\n> fork. If it came from a fork, the token has only read permissions.\n>\n> So I'd say we're still safe.\n\nYeah, their blog post came to my inbox, which was quite timely, this\nmorning ;-).\n\nhttps://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/\n\n"}]}