From ed1943058a898184649d2bb8067cb9d0d1dfd727 Mon Sep 17 00:00:00 2001 From: Mohamed Boudra Date: Tue, 12 May 2026 12:37:01 +0700 Subject: [PATCH] ci: gate nix-build on same-repo PRs only scripts/update-nix.sh and scripts/fix-lockfile.mjs are executed from the PR's checked-out tree. A fork PR can modify those scripts to run arbitrary code on the runner. Same-repo PRs and push-to-main still run; fork PRs skip the job entirely. Closes #365. --- .github/workflows/nix-build.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml index b86331434..17d7783ab 100644 --- a/.github/workflows/nix-build.yml +++ b/.github/workflows/nix-build.yml @@ -37,6 +37,11 @@ permissions: jobs: build: + # Skip fork PRs: this workflow executes scripts/update-nix.sh and + # scripts/fix-lockfile.mjs from the checked-out tree. A fork could + # edit those to run arbitrary code on the runner. Same-repo PRs and + # main pushes still run. + if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: actions/create-github-app-token@v1