adding tmate session and documentation around it #359
Conversation
Gregory-Pereira
force-pushed
the
add-tmate-session-to-workflows
branch
4 times, most recently
from
eb82fb2 to
9cba9d5
Compare
|
RFR |
Gregory-Pereira
force-pushed
the
add-tmate-session-to-workflows
branch
from
9cba9d5 to
1638b08
Compare
Signed-off-by: greg pereira <[email protected]>
Gregory-Pereira
force-pushed
the
add-tmate-session-to-workflows
branch
from
1638b08 to
6752f71
Compare
|
|
||
| With `limit-access-to-actor` set to `true`, the action look who created the PR, and grab the public SSH keys stored in their Github account. | ||
| It will reject connections from any SSH private key that does not match the public key listed in the Github account. | ||
| This is recommended, as it prevents others from abusing your runners, but may be dissabled to allow a teamate to ssh instead. |
There was a problem hiding this comment.
This seems like a really bad idea to allow an arbitrary PR author to ssh into a CI runner. Is that what this does?
There was a problem hiding this comment.
Yes, it will allow a PR author to ssh into an ephemeral Github hosted runner, it is not to a self-hosted piece of infrastructure, but that is what this does. It is useful for debugging purposes. Should I comment them out or close the PR?
There was a problem hiding this comment.
Right -- so bad actor A can open a PR and then ssh in to use it to mine MeowCoin or whatever
or worse, bad actor A gets to ssh in to build and push stuff to our image registry.
There was a problem hiding this comment.
Got it, closing the issues then. Although I think this is more of a CI permissions issue ... because someone could still just include this action in any pr they run and achieve the same result. Regardless I will close this up now, if we want we can always reopen it.
There was a problem hiding this comment.
That's true. I believe we have it set so at least the first time someone submits a PR an approval is required for CI to run. That's a pretty low bar to get past, though. We've got to change the setting to always requiring approval for outside collaborators.
Gregory-Pereira
added
training-data-approved
Addresses #357 and comments in #349
/cc @nerdalert @vishnoianil