Introduction
I think I found some things for you to look into. I've linked to relevant documentation so you can review the docs and decide what to do. ๐
Things to check
pull_request_target
in workflow files
You're using pull_request_target
in your workflow files, for example:
This may be dangerous. Here's a quote from GitHub's security lab blog post: 1
TL;DR: Combining pull_request_target
workflow trigger with an explicit checkout of an untrusted PR is a dangerous practice that may lead to repository compromise.
Manually approve workflow run from public forks
You may want to require manual approval before a workflow runs from a public fork. Quote: 2
Anyone can fork a public repository, and then submit a pull request that proposes changes to the repository's GitHub Actions workflows. Although workflows from forks do not have access to sensitive data such as secrets, they can be an annoyance for maintainers if they are modified for abusive purposes.
To help prevent this, workflows on pull requests to public repositories from some outside contributors will not run automatically, and might need to be approved first. By default, all first-time contributors require approval to run workflows.
Note
Workflows triggered by pull_request_target
events are run in the context of the base branch. Since the base branch is considered trusted, workflows triggered by these events will always run, regardless of approval settings.
Because you're using pull_request_target
the workflow ran immediately on my PR, as mentioned in the quote above.
Security hardening for GitHub Actions
GitHub has good documentation on how to improve the security hardening of your actions. 3
This guide explains how to configure security hardening for certain GitHub Actions features.