github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-18 19:18:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

more security notes

Browse Source 
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
This commit is contained in:
Ramon Petgrave
2024-04-24 17:12:24 +00:00
parent 023594f07c
commit 129f707e41
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/post-commit.yml
+5
View File
@@ -1,9 +1,14 @@
# A workflow to run against renovate-bot's PRs,
# such as `make package` after it updates the package.json and package-lock.json files.
# The potentially untrusted code is first run inside a low-privilege Job, and the diff is uploaded as an artifact.
# Then a higher-privilege Job applies the diff and pushes the changes to the PR.
# It's important to only run this workflow against PRs from trusted sources, after also reviewing the changes!
# There have been vulnerabilities with using `git apply` https://github.blog/2023-04-25-git-security-vulnerabilities-announced-4/
# At this point a compromised git binary could modify any branch except `main` and `release/*`, due to our branch protection rules and CODEOWNERS.
# It may also be able to submit a release https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs#overview
name: Post-Commit
permissions: {}