mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-22 01:13:00 +02:00
Richard Alpe
0b8d3307db
Allow a workflow caller to run pre-build scripts though a workflow call variable. This is potentially dangerous as code can be injected here. If for example a malicious actor wants to run there C2 code in the context of someone else they could perhaps inject it here. I assume this is protected by the same mecahism as the workflow files themself. I.e. github users untrusted to the Infix org won't be able to trigger workflows before being explicitly allowed to do so. This patch also adds a checkout secret. This allows upstream callers to fetch there own spin / fork though the infix workflows, if they provide a checkout token with the correct permissions to do so. Signed-off-by: Richard Alpe <richard@bit42.se>