Never heard of pull_request_target before today and I think I'm with him, I don't know what I would possibly use it for that would justify the risk of unreviewed code getting access to build environments. Seems bananas.
Misconfigured GH Actions hijack - Low Level - YouTube
https://www.youtube.com/watch?v=uwSjgv4otAk
1 Comments
anton@lemmy.blahaj.zone · 2 pts · 157d
It was bound to happen, as github actions are mess.
Im just happy that AI bros got hit this time, instead of something important.