alt Hacker News> The biggest mitigation is that gitea documentation discourages you from using action runners from untrusted users.
This recommendation seems incompatible with third-party collaboration, at least on its face!
Replies
m4rtink • yesterday at 12:19 PM
The idea is you first review PRs from external contributors before allowing the CI to run on them.
➕ show 1 reply
dspillett • last Saturday at 8:26 PM
Potentially, but for many projects things like that are tools that you want to control access to anyway. Anyone wanting to update the CI/CD process who isn't a trusted part of the project should be having their changes properly reviewed by someone who is anyway, at which point the reviewer is the trusted user not the random external entity.
➕ show 1 reply
Many projects have CI setups that run code (Makefile can run any code, for example). Which means, an untrusted third-party contribution would allow that party to run arbitrary code on CI platform. Yes, the solution is to not let untrusted third-party code to be run without manual review.