Ensure code does not expose environment variables about sandpaper HOT 3 CLOSED

Interesting development: The PR action that is run comes from the repository of the requestor.

from sandpaper.

I've confirmed that it is possible for someone to modify a PR action to create bogus artifacts: zkamvar/testme@348d663

What I need is a sentinel action using pull_request_target to get a list of the changed files since that action will run in the base of the repository.

from sandpaper.

Update: Based on the workflow in https://securitylab.github.com/research/github-actions-preventing-pwn-requests, I've created an action that will check that the incoming PR is valid and conditionally run the other steps based on that action: https://github.com/zkamvar/check-valid-pr/

In action, it looks like this:

https://github.com/zkamvar/testme/blob/d81af212590c18ea02756645408effaabf238f50/.github/workflows/comment-pr.yaml#L62-L77

Because it's in the action that's triggered by the completion of another action, we don't have to worry about the action creating bogus artifacts to spoof another pull request that IS valid. That being said, at the moment, it's possible to force the PR to successfully complete the action it will take the outputs and comment on a separate PR if it is still an open PR: zkamvar/testme#23 (comment)

from sandpaper.