git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Random GitHub Actions added to git/git???

From
Junio C Hamano <gitster@pobox.com>
Date
Apr 21, 2021, 23:05 UTC
Message-ID
<xmqqlf9bxmqj.fsf@gitster.g>
In-Reply-To
<nycvar.QRO.7.76.6.2104211437040.54@tvgsbejvaqbjf.bet>
Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:
Show 11 quoted lines
> On Tue, 20 Apr 2021, Junio C Hamano wrote:
>
>> How well are our refs protected from these random "Actions"?  Can
>> somebody spam us with a pull request with a new "workflow" that
>> advances one of our integration branches ;-)?
>
> The GITHUB_TOKEN that is used by the GitHub workflows is generated in two
> ways, depending whether a PR originated from the same repository or from a
> fork. If it came from a fork, the token has only read permissions.
>
> So I'd say we're still safe.

Yeah, their blog post came to my inbox, which was quite timely, this morning ;-).

https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
Previous: Johannes Schindelin
Message 9 of 9 in “Random GitHub Actions added to git/git???”
  1. Junio C HamanoApr 20, 2021
  2. Taylor BlauApr 20, 2021
  3. Taylor BlauApr 20, 2021
  4. Bagas SanjayaApr 20, 2021
  5. Johannes SchindelinApr 20, 2021
  6. Johannes SchindelinApr 20, 2021
  7. Junio C HamanoApr 20, 2021
  8. Johannes SchindelinApr 21, 2021
  9. Junio C HamanoApr 21, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.