[neximo64]

Cant you create a github action in a commit that simply spits the secret out? Anyone know how to prevent this hack? Is there a way to have an open repo except for the actions folder?

[jsmeaton]

You can prevent forks from running actions which guards against external parties.

Nothing to be done about internal parties except policies.

[neximo64]

Policies, a verbal rule with your devs?

[skybrian]

Mandatory code review would do it.

[jsmeaton]

Not really, because people could change the action on their PR and have it run. Unless you've got a fork based workflow internally.