Post

most of these github actions driven breaches are because of pull_request_target. here's some tips of what to look for when reviewing your own workflows. worth noting - it is safe, and necessary, when used correctly 🧵

the pull_request_target trigger runs a workflow when a PR is opened against the target (base) repo. this means the workflow runs in _context_ of that repo, i.e. has access to secrets and what not. by default, the `checkout` action will checkout _the base repo_ (NOT the fork)

it needs a lot more care when this is introduced... now we're checking out the FORK in the context of the base repo. still safe, though! as all we've done is check out some sources - we haven't run anything at this point.

now is where we need to take extra care. if we now run `pnpm i` (with install scripts enabled), the fork can just declare a prepare script which sends github secrets off somewhere - excellent. TIP: `--ignore-scripts` _or_ avoid running install in this context at all

could we just install packages before checking out the fork?