pull_request_target 㧠GitHub Actions ã®æ”¹ç«„を防ã本記事ã§ã¯ GitHub Actions 㧠pull_request event ã®ä»£ã‚ã‚Šã« pull_request_target を用ã„〠workflow ã®æ”¹ç«„を防ã„ã§ã‚ˆã‚Šå®‰å…¨ã« CI を実行ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ ã¾ãšã¯å‰ç½®ãã¨ã—ã¦èƒŒæ™¯ã‚„解決ã—ãŸã„ã‚»ã‚ュリティ的ãªèª²é¡Œã«ã¤ã„ã¦èª¬æ˜Žã—ãŸå¾Œã€ pull_request_target を用ã„ãŸå®‰å…¨ãª CI ã®å®Ÿè¡Œã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ 本記事ã§ã¯ OSS 開発ã¨ã¯é•ã„æ¥å‹™ã§ private repository を用ã„ã¦è¤‡æ•°äººã§é–‹ç™ºã‚’è¡Œã†ã“ã¨ã‚’å‰æã«ã—ã¾ã™ã€‚ é•·ã„ã®ã§è¦ç´„ GitHub Actions 㧠Workflow ã®æ”¹ç«„を防ãŽãŸã„ GitHub ã® branch protection rule ã‚„ codeowner, OIDC ã ã‘ã§ã¯ä¸å分ãªã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹ pull_request event ã®ä»£ã‚ã‚Šã« pull_r
GitHub Actionsã«ã€Œå¼·ã„ã€AWSã®æ¨©é™ã‚’渡ã—ãŸã„ ~作戦3 - AssumeRole with Google ID Token ~ - KAYAC engineers' blog
GitHub - sorah/envchain: Environment variables meet macOS Keychain and gnome-keyring <3
EC2インスタンスã®ç§˜å¯†éµã®ç®¡ç†ã‹ã‚‰é–‹æ”¾ã•ã‚Œã‚‹ ssos (ssh-setup-over-ssm) をリリースã—㟠- 京都行ããŸã„
GitHub - awslabs/git-secrets: Prevents you from committing secrets and credentials into git repositories
https://blog.ssrf.in/post/example-of-attack-on-gce-and-gke-instance-using-ssrf-vulnerability/
GitHub ã« AWS ã‚ーペアを上ã’ã‚‹ã¨æŠœã‹ã‚Œã‚‹ã£ã¦ã»ã‚“ã¨ï¼Ÿï¼Ÿï¼Ÿè©¦ã—ã¦ã¿ã‚ˆãƒ¼ï¼ - Qiita
ã‚¯ãƒ©ã‚¦ãƒ‰ç ´ç”£ã—ãªã„よã†ã« git-secrets を使ㆠ- Qiita
{{#tags}}- {{label}}
{{/tags}}