@onlinepersona@programming.dev
Post #3642966
2026-07-07 07:19 UTC
The article doesn’t seem to say. I don’t know if it’s a problem with defaults or caused by the devs themselves.
Replies (2)
-
@real_username56@lemmy.ml 2026-07-07 12:29
As far as I can tell it requires GitHub actions to be enabled for pull requests, which you can require approval for. I just quickly read the top of the article so I could be wrong
-
@minfapper@piefed.social 2026-07-07 17:18
By default pull requests my new contributors require approval from someone with write-access to the repo before running actions. These repos have specifically decided to change a setting to make them not require approval for anyone. The UI to change that setting explicitly warns you about exactly this attack, so this “article” feels like a non-item trying to farm engagement.