puter/paseo
1
0
Fork 0
mirror of https://github.com/getpaseo/paseo.git synced 2026-07-29 12:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: gate nix-build on same-repo PRs only

Browse Source 
scripts/update-nix.sh and scripts/fix-lockfile.mjs are executed from
the PR's checked-out tree. A fork PR can modify those scripts to run
arbitrary code on the runner. Same-repo PRs and push-to-main still
run; fork PRs skip the job entirely.

Closes #365.
This commit is contained in:
Mohamed Boudra
2026-05-12 12:37:01 +07:00
parent e0361ddd22
commit ed1943058a
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.github/workflows/nix-build.yml vendored
View File

@@ -37,6 +37,11 @@ permissions:
jobs: jobs:
build: build:
# Skip fork PRs: this workflow executes scripts/update-nix.sh and
# scripts/fix-lockfile.mjs from the checked-out tree. A fork could
# edit those to run arbitrary code on the runner. Same-repo PRs and
# main pushes still run.
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/create-github-app-token@v1 - uses: actions/create-github-app-token@v1