On Wed, Dec 30, 2020, 12:45 AM Jarek Potiuk <jarek.pot...@polidea.com>
wrote:
> One comment about PIP/NPM packages - it's a very different level of threat
> IMHO.
>
> Installing and even running commands via PIP does not expose GITHUB_TOKEN
> (and this is the real threat). It at most exposes the local build
> environment to be hacked for the time of build but as long you are using
> Github Actions, the token is only available to those specific actions.
> As Vladimir noticed - GITHUB_TOKEN is only available to actions where it is
> specified in the action's Yaml file. It is not available if the
> action (whether it is bash command or python command does not have ${
> secrets.GITHUB_TOKEN } in their configuration as an environment variable or
> part of the command. This is very different from any non-trivial action
> because you have to pass the token to make it work.
This is only sorry of correct. If you are using the standard checkout
action and install a package from pypi/npm at a later step that package
absolutely can push to the Apache repo when it runs in a push context (pr
context it is read-only). This later step does not need the token passed to
it.
>From the readme:
"""The auth token is persisted in the local git config. This enables your
scripts to run authenticated git commands. The token is removed during
post-job cleanup. Set persist-credentials: false to opt-out."""
If the concern is pushing code to Apache repos the story for Actions and
other packages is basically the same if you are not fully pinning. I don't
think that's a bad thing, people probably just don't think in this context
for Actions.
--Brennan
