Skip to content

Add workflow to search and destory pull_request_target #13

@AB-xdev

Description

@AB-xdev

GitHub Actions has the possibility to run on workflow event pull_request_target.

This event is known to be unsafe since at least 2021 and GitHub has "tried" multiple times to fix this. However even now - 5 years later - there is still no option to disable this security hole.

This idiotic stuff just compromised Trivy, which causes a massive cleanup action and I will not let it happen to us.

TODO:

  • Create a workflow that searches for occurrences of pull_request_target in our workflow and opens an issue and notifies me when this is the case

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions