|
|
|
|
|
|
by insanitybit
1 day ago
|
|
|
Trusted Publishing pins the publish to the workflow. The next step is to isolate "run untrusted code (`npm build`)" from "publish" in your workflows. Now you have two properties - the publish can only happen from one place and the publish is isolated from untrusted code execution. |
|
|