Post #2098483
2026-04-15 11:55 UTC
@marijn @tisba I run a couple of runners both for GitLab but also for Forgejo, including one that runs against Codeberg.
I'm, all of a sudden, wondering what the threat scenario is? worms in external dependencies?
Replies (2)
-
@marijn@mastodon.social 2026-04-15 11:56
@halfbyte @tisba If you run them on unmerged PRs, people can inject code into a process running on your forgejo server, and you'd have to hope that that is well-isolated. If you don't, you just have to be careful about merging code.
-
@tisba@ruby.social 2026-04-15 12:06
@halfbyte @marijn build docker/oci images on Codeberg is a PITA. I have given up for now to look for a solution. I don't recall exactly what the reason was, that you cannot use Docker on Codeberg with Forgejo Actions, but it was for security reasons to isolate the host from jobs. The thread is PRs from others, but also supply chain isolation. You don't want your next compromised npm package to be able to get persisted on your CI host.