A workflow that runs forks with secrets
Review a repository’s GitHub Actions workflows. Find the one that checks out untrusted pull request code under pull_request_target, the secret it exposes, and the unpinned action.
Briefing
pull_request_target runs in the context of the base repository, with its secrets and a write token, even for pull requests from forks. That is safe only if the workflow never runs the fork’s code.
Third-party actions referenced by a branch or tag can change under you. A full commit SHA cannot.
dev-laptop · Supply chain
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.