Post #2098484
2026-04-15 11:56 UTC
@halfbyte @tisba If you run them on unmerged PRs, people can inject code into a process running on your forgejo server, and you'd have to hope that that is well-isolated. If you don't, you just have to be careful about merging code.
Replies (1)
-
@halfbyte@ruby.social 2026-04-15 12:06
@marijn @tisba Okay, true. I'm running these mostly for projects that don't have external contributors. That's different for your projects, I guess. That does make it a lot scarier.