cachix/cachix-action
1
0
Fork 0
mirror of https://github.com/cachix/cachix-action.git synced 2025-06-08 07:07:00 +09:00
Code Activity

Merge pull request #187 from zimeg/docs-security-tokens

Browse source 
docs(fix): note that action secrets are unavailable to just prs from forks
This commit is contained in:
sander 2024-11-15 18:29:26 +04:00 • committed by GitHub
commit 03d852faca
Signed by: github
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
README.md
View file

@ -22,17 +22,16 @@ See [action.yml](action.yml) for all options.
Cachix auth token and signing key need special care as they give read and write access to your caches.
[As per GitHub Actions' security model](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets#using-encrypted-secrets-in-a-workflow):
[As per GitHub Actions' security model](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#accessing-your-secrets):
> Anyone with write access to a repository can create, read, and use secrets.
> You can use and read secrets in a workflow file if you have access to edit the file.
Which means all developers with write/push access can read your secrets and write to your cache.
Which means all developers with write/push access can read your secrets and write to your cache.
Pull requests do not have access to secrets so read access to a public binary cache will work,
Pull requests from forks do not have access to secrets so read access to a public binary cache will work,
but pushing will be disabled since there is no signing key.
Note that malicious code submitted via a pull request can, once merged into `master`, reveal the tokens.
Note that malicious code submitted via forked pull request can, once merged into `master`, reveal tokens.
## Hacking